Data Reforms Kick In: What the DUAA Means for Casino Players and Operators

_{ICO (DUAA) enters next phase. (Image: Alan Evans/Casinos.com)}

The UK’s Data (Use and Access) Act (DUAA) entered its next phase on 5 February 2026, bringing most of its updated data protection rules into effect. While the bulk of the provisions are now active, two key elements remain on the horizon: a mandatory complaints procedure set for 19 June 2026, and additional governance reforms for the Information Commissioner’s Office (ICO) that will follow at a later date.

Greater Clarity and Control for Players

For players at both land-based and online casinos, the new rules offer greater clarity and control over how personal information is handled. Individuals now have improved access to their personal data, supported by strengthened rights around Subject Access Requests (SARs). The legislation also mandates that casinos build privacy protection into their systems from the ground up, a principle known as “data protection by design and by default.”

More importantly, the ICO now has sharper tools to enforce compliance. It can investigate data breaches more efficiently and impose substantial fines for violations, up to £17.5 million or 4% of a company’s global turnover, under the Privacy and Electronic Communications Regulations (PECR). That added accountability means players can expect their information to be handled with more care than ever.

More Flexible Rules Around Data Usage

For operators, the DUAA presents a blend of legal obligation and strategic opportunity. The Act introduces more flexible rules around data usage, which could unlock smarter approaches to customer engagement and innovation, so long as privacy protections remain intact.

It also raises the standard for transparency. Casino operators must clearly communicate how and why they collect player data, ensuring users are fully informed about its usage. At the same time, the ICO has gained new powers to compel witness interviews and demand technical reports during investigations. These expanded enforcement capabilities raise the stakes for non-compliance and are set to reshape how UK operators approach data governance.

The ICO has already updated its guidance on Subject Access Requests and published revised Part 3 codes of conduct for law enforcement-related data. Operators are urged to review these documents and prepare for the next phase of regulatory expectations.  

What to Expect Next

The final stage of the DUAA rollout, the mandatory introduction of internal complaints procedures, will take effect on 19 June. The ICO has confirmed that further guidance will be released throughout 2026 to help organisations adjust. Operators are advised to audit their current systems and ensure they’re fully compliant ahead of the deadline.

For players, the reforms should lead to simpler, more transparent interactions when requesting access to personal data or inquiring about how it’s being used. In an industry where trust and security matter, the DUAA marks a shift toward a more accountable and user-focused environment.