Scoring a subscription commerce regulatory watchlist

What to take away

Which changes deserve a place on your 2027 watchlist?

Set the inclusion criteria before the list, or it drifts.

Use these four regulatory candidates as a watchlist, not as evidence of commercial trends:

The Data (Use and Access) Act 2025 (Commencement No. 1) Regulations 2025 commence Part 1, concerning access to customer and business data in connection with developing Smart Data schemes. They also commence specified Part 5 provisions amending the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003. Check the relevant provisions in the commencement regulations against your planned activity.

For each candidate, note the provision, territorial scope and commencement status; enacted status alone does not establish that a provision is in force.

Treat this as a UK watchlist, not a single rulebook: verify territorial scope before applying a product-safety process across all four nations.

How do you score each candidate before you spend?

Give every candidate the same questions and a score out of five for each. Total them in a planning meeting rather than in a spreadsheet argument. Weights are yours to set; a regulated operator might weight exposure higher than reversibility.

Worked example for the Leeds box brand assessing the Digital Markets, Competition and Consumers Act 2024:

Set a local ceiling for external advice and staff time. Any candidate above either limit goes to the March finance review, where the team can decide whether the exposure justifies the spend.

For example, a recurring tool commitment scores reversibility 2 out of 5, while a one-off compliance fix scores reversibility 5 out of 5.

A candidate with strong evidence but weak cost control stays on a watching brief. A candidate with high exposure and low reversibility goes into the next planning cycle.

How do UK rules change subscription operations?

The Data (Use and Access) Act 2025 reshapes parts of the UK data framework, including automated decision-making, research uses and enforcement. Read the Act rather than a second-hand summary of it. Use the commencement regulations in the watchlist above to identify which provisions apply to your planned activity. Marketing consent sits in the same file, so keep the wording, the timestamp and the source of every permission you rely on.

If your platform, email vendor or analytics tool sits outside the UK, the ICO's international transfers guidance sets out the safeguards you need. It also lists the paperwork to complete before subscriber data leaves the country.

For boxes holding physical goods, check product-safety requirements for the territory where you sell, including labelling, testing and record-keeping. Those duties stay with you even when a third party packs and ships the box.

Where do skills and roles fit?

Compliance and retention work lands on the same small team. Decide early who owns consent records, transfer documentation and product-safety files, or the work stalls on the same two people. Make ownership and cover part of the budget discussion so these operational tasks do not compete invisibly.

Common questions

Does one 2027 plan cover England, Scotland, Wales and Northern Ireland?

For data work, one UK consent and transfer process can normally cover all four nations. For product safety, verify territorial scope before assuming one box specification works everywhere.

How often should the watchlist be refreshed?

Quarterly suits most operators: review in the first week of January, April, July and October. Add an extra pass in March for the finance review and when the ICO publishes its annual report. Add an extra pass when a platform gives 30 days notice of a terms change.

Should I act before the evidence settles?

No. Use the rubric to park weak candidates on a watching brief. Revisit them when the evidence or your own renewal data improves.