The Regulations mandated the Information Commissioner to create a data protection code of practice for AI and automated decision-making, while simultaneously excluding national security considerations from the oversight panel's review.

These 2026 Regulations require the Secretary of State to direct the Information Commissioner to prepare an official code of practice offering guidance on good practice for processing personal data when developing and using artificial intelligence and automated decision-making systems, specifically including provisions for children's data.

Furthermore, the regulations modify existing law by ensuring that any advisory panel considering the code must exempt aspects related to national security from their review process.

The Regulations amended numerous secondary legal instruments to align with the Data (Use and Access) Act 2025, repealed a section of the Data Protection Act 2018 concerning recordable offences, and updated electoral and company disclosure rules concerning data processing safeguards.

These Regulations finalize the transition following the enactment of the Data (Use and Access) Act 2025 by making necessary consequential amendments across various pieces of UK legislation.

Key actions include repealing a section of the Data Protection Act 2018 concerning recordable offences while simultaneously updating regulations to ensure the new offence of making false statements in response to an interview notice becomes recordable, and revising numerous electoral and company disclosure rules to align references from the UK GDPR concerning data processing for research and archiving purposes (replacing references to Article 89 with Article 84A).

The Regulations specified the public bodies now recognized as 'qualifying competent authorities' permitted to engage in joint, national security-related personal data processing with UK intelligence services under the Data Protection Act 2018.

These Regulations, made by the Secretary of State under the Data Protection Act 2018 (DPA), specify which public bodies qualify as 'qualifying competent authorities' to engage in joint processing of personal data with intelligence services under Part 4 of the DPA, a power enabled by the Data (Use and Access) Act to assist in safeguarding national security; the instrument lists various government departments, police forces, customs, and judicial/monitoring bodies as qualifying authorities, citing consultation with the Information Commissioner and Parliamentary approval, and stipulates that the regulations come into force twenty-one days after being made and extend across the UK.