Clifford Chance

The UK Information Commissioner's Office (ICO) has several draft guidance documents open for consultation, at time of writing, including:

• A new chapter within the draft updated Guidance on Storage and Access Technologies, previously known as the 'cookie guidance' (closing 26 September 2025 – responses can be submitted here);
• Complaints Guidance for Organisations (closing 19 October 2025 – responses can be submitted here);
• Recognised Legitimate Interest Guidance (closing 30 October 2025 – responses can be submitted here) - There was also a related consultation on Recognised Legitimate Interest: Requesting Personal Information for Public Tasks and Official Functions (closing 30 October 2025 – responses can be submitted here);
• Guidance on Profiling Tools for Online Safety (closing 31 October 2025 – responses can be submitted here); and
• Distributed Ledger Technologies (DLT) Guidance (closing 7 November 2025 – responses can be submitted here). 

Click on the links above for our overviews of the draft guidance.

Wider context

The ICO has published its plan for a pipeline of new and updated guidance, including across data protection, direct marketing and e-communications, children's information and technology. Several of the planned guidance documents will form an important part of understanding how to apply the Data Use and Access Act 2025 (DUA Act). See our briefing: UK Data Reform: What you need to know about the Data (Use and Access) Act.

The ICO has been running a number of parallel initiatives and it is not always clear how they link to or overlap with each other. Some of the open consultations also have similar names or address similar issues from different perspectives. For example, the ICO is also consulting on draft changes to how it handles data protection complaints in connection with its proposed complaint handling framework (closing 31 October 2025 – responses can be submitted here). It has also issued draft guidance on Recognised Legitimate Interest: Requesting Personal Information for your Public Tasks or Official Functions for organisations that have public tasks or official functions, such as public authorities, which is under consultation until 30 October 2025.

Other recent ICO consultations and calls for views have related to draft guidance on the consumer Internet of Things, its approach to enforcement of PECR consent requirements for cookies and similar technologies, international transfers guidance and guidance on encryption.

ICO guidance and consultations should be monitored alongside other developments that will inform the application of the DUA Act, including potential updates to follow in the wake of the Department for Science, Innovation and Technology's call for evidence on smart data opportunities in digital markets, which closed on 15 September 2025.