Privacy Regulations 2025: transition guide

What changed in April 2026

The Privacy Regulations 2025 commenced and repealed the 2013 regulations. Historical conduct can still require the version in force at that time.

What businesses should do now

Update policies, templates, training and advice links to the current regulations while preserving dated references where a historical provision continues to govern earlier conduct.

• Map the live data flow, including temporary systems, pixels, vendors and onward disclosures.
• Confirm necessity, authority, notice, consent and purpose for each material use or disclosure.
• Reconcile intended privacy settings with live states across downstream systems.
• Apply access, configuration, monitoring, deletion and incident controls to non-production environments.
• Retest after changes to websites, vendors, migrations, permissions or data fields.

Evidence to retain

• Current data maps, system inventories and supplier responsibilities.
• Privacy assessments, notices, consent records and decision logs.
• Access reviews, configuration evidence, monitoring records and verified deletion.
• Incident chronology, assessment decisions, notifications and remediation evidence.

Turn the issue into a controlled decision

• Record the affected product, claim, customer journey, system, supplier or business process.
• Separate current requirements from proposals, priorities, allegations, warnings and matter-specific outcomes.
• Assign an owner, action date and evidence location for every material gap.
• Set review triggers for legal changes, new facts, supplier changes, incidents, complaints and campaign variations.
• Escalate when the available facts or evidence do not support the proposed decision.

Questions to ask

Focus on the decision and the evidence.

1. 01

   What personal information is actually collected, inferred, used, disclosed and retained?

2. 02

   Do privacy conclusions match the exact dataset, system, purpose and time period?

3. 03

   What evidence shows that the control works across suppliers and downstream systems?

Primary sources

Check the controlling material.

• Current legislation ↗

Related resources

Continue with this topic.

Recommended training

Practical support

Apply the guidance to your facts.

Identify the exact product, claim, customer journey, supplier, legal entity or process involved. Preserve the information that supports the current position, record unresolved facts, assign an owner and confirm the point at which specialist review is required.

Important information

Check the current position.

This resource is general information, not legal advice. Laws, official guidance and proposals can change. Do not rely on a title or summary alone to decide whether a requirement applies to a particular entity, product or activity.