The Data (Use and Access) Act, introduced in the House of Lords on 23 October 2024, represents a significant legislative effort by the UK government to modernise the nation’s data framework, following the introduction of GDPR in 2018.
On 19th June, 2025, the DUA Bill was granted Royal Assent and is now known as the UK Data (Use & Access) Act 2025, or DUAA 2025.
At this point, it is important to clarify The DUA Act 2025 will amend the existing UK data protection laws, not replace them. This means, we will still have the three primary underlying laws; UK GDPR, Data Protection Act 2018 and PECR 2003. They’ll just look a bit different. Some changes will take effect immediately, however most will be in place by June 2026. The ICO is currently working on updating their guidance.
If you’re an organisation, we’ve also covered what the Data (Use and Access) Act 2025 means in practice for businesses.
Background
To give some background, reforms to data protection legislation were first proposed by the Conservative Government, promising to “overhaul” data protection legislation post-Brexit. The early version of these reforms were more radical – even abolishing the requirement for Data Protection Officers (DPOs).
The Labour Government then introduced their version of new legislation in October 2024 with far fewer significant changes – the UK and EU laws still remain very closely aligned, which it is hoped will improve the chances of our post-Brexit adequacy being renewed. The renewal of the UK’s adequacy agreement by the European Commission (following Brexit) has been postponed until December 2025 to allow the new legislation to “bed in”. Realistically, however, there are unlikely to be any challenges to this and the UK’s adequacy should be renewed.
The Bill would have been passed long ago, had it not been for attempts by Peers in the House of Lords to introduce new transparency obligations by AI developers in respect to holders of copyright in training data. These amendments were supported by high-profile performing artists such as Elton John and Dua Lipa who argued tech firms could train their AI products to mimic these artists, without having to pay for it. These clauses were rejected by the Commons, so are not in the final version of the law, however there is already separate consultation around AI copyright, so this is likely to be addressed in the future.
What it replaces or amends (UK GDPR, DPA 2018, PECR)
The Act does not replace existing UK data protection law. Instead, it amends and updates the current framework. The main underlying legislation remains in place, including:
- UK General Data Protection Regulation (UK GDPR)
- Data Protection Act 2018
- Privacy and Electronic Communications Regulations (PECR)
These laws remain in force, with the Act introducing amendments to specific provisions.
Political and legislative context
The legislation was subject to parliamentary debate, including amendments proposed in the House of Lords relating to transparency requirements for artificial intelligence systems and the use of copyrighted materials in AI training data. While some of these proposals were not included in the final Act, the topic remains under separate policy review and consultation.
AI and copyright discussion
One of the key areas of debate during the passage of the Bill was the use of copyrighted material in training artificial intelligence models. Concerns were raised by public figures and creative industry stakeholders about how AI systems access and reproduce creative works. Although related amendments were not included in the final legislation, this area is expected to remain part of ongoing regulatory and policy discussions.
Complaints to the Information Commissioner’s Office (ICO)
Under the current UK GDPR, people have a right to complain directly to the ICO in relation to the processing of their personal data – irrespective of the severity of the complaint. Under the Data (Use and Access) Act 2025, individuals will first be required contact an organisation (data controller) regarding their complaint. If they feel the organisation is not taking this complaint seriously, or the organisation fail to respond in a timely manner, then it should be escalated to the ICO. It is hoped this will reduce the number of complaints to the ICO – meaning they only deal with the more severe cases – it will also give organisations the chance to handle any complaints internally.
This new process will require business owners to establish new processes to ensure they can respond to any complaints within 30 days. Formal records will need to be kept on the number of privacy-related complaints in a specific time period. Failure to respond in this time frame may result in difficult questions from the regulator – and see an increase in enforcement activity from the ICO.
Additionally, there are also plans for the ICO to be replaced by an Information Commission, which will be run in a similar fashion to other regulatory bodies such as the FCA and OFCOM.
Data subject access requests (DSARs)
Organisations (Data Controllers) will be able to “stop the clock” on Data Subject Access Requests if more information is required, or the identity of the data subject needs verifying. Requests will need to be “reasonable and proportionate”, otherwise they can be declined – it is hoped this will avoid SAR’s being used against an organisation, rather than a genuine request for copies of data. The parameters for “reasonable and proportionate” will need to be set by the ICO.
Data Subject Rights
Right to Portability
- The direct sharing of data between certain organisations or regulated third parties will be permitted, without you having to consider the risks. This will facilitate the sharing of data for investigations and where there is concern for an individual, or regulatory (but not legal) investigation.
- The responsibility of any data being shared lies with the organisation making the request. It is hoped this will aid the sharing of data where there’s an overall public interest.
Right to be Informed
- Article 13 requires full details of the data controller to be provided to the data subject whenever personal data is being collected – most typically in the form of a privacy notice that is readily available.. and relevant! Many privacy notices contain general processing information, but not necessarily relevant to the specific activity.
- Article 14 requires details on the data controller to be provided to the data subject without undue delay in instances where data is collected by a third party. “Undue delay” is usually interpreted as “within 30 days”. This has always been challenging, especially where large volumes of data are collected for marketing purposes. If either of these involves “disproportionate effort”, the organisation will not be obliged to do provide this.
Recognised legitimate interests
If you rely on legitimate interest for one of the “recognised, pre-approved” reasons, then there is no need to complete a legitimate interest assessment (LIA) to demonstrate you’ve considered the rights of all parties – ie, the data subject and data controller. In instances your use is NOT on the pre-approved list, then you’ll still need to complete an LIA.
The “recognised, pre-approved” legitimate interests are:
- Disclosures to public bodies, where it is asserted personal data is necessary to fulfil a public function.
- Disclosures for national or public security or defence purposes, emergencies.
- Disclosures for prevention of detection of a crime, and safeguarding vulnerable individuals.
Soft opt-in for marketing to charities
One of the more significant changes – if you’re a registered charity – you will be permitted to send electronic marketing messages (emails / SMS / WhatsApp) as long as they support or directly express interest in your work. Unless they specifically object. If you have obtain a contact from a 3rd party, you’ll still need to rely on consent.
Legitimate interest as a lawful basis
Legitimate Interest will be accepted as a lawful basis for direct marketing purposes. The direct marketing laws under PECR (Privacy and Communication Regulation 2003) will still apply, so this doesn’t mean this lawful basis can be used as default This will not be a free-for all.. fines under PECR are also increasing substantially… more on that below!
Privacy and Electronic Communication Regulation 2003 (PECR) Fines
The Information Commission’s fining powers have increased significantly from a cap of £500,000 to in line with GDPR.
This means, any failures involving marketing – cookie use, email / SMS broadcasting, telemarketing, etc could lead to fines of up to £17.5m or 4% of global turnover.
The ICO are very active in PECR fines, so any organisations undertaking mass direct marketing should carefully review their activities.
Spam Emails and Text Messages
Historically, PECR investigations for spamming have been based on the number of DELIVERED messages. Any investigation will now be based on the number SENT messages – so based on the original intention of the organisation.
Special Category Data
New categories have been introduced, such as Neurodata which is information gathered from devices or technologies that interact with the human brain or nervous system, such as smartwatches.
Cookies
it will be permissible to drop cookies and similar technologies on websites for the purposes of analytics and optimising content – but an opt-out must be provided. This will allow owners of websites to track users and their activity to improve the experience and success of the site, without the need for consent.
Children and online services
If you provide an online service that is likely to be used by children, the DUA Act 2025 explicitly requires you to take their needs into account when you decide how to use their personal data. Much of this should already be addressed if you conform to the ICO’s Age Appropriate Design Code (AADC).
Research Provisions
The DUA Act 2025 makes it clearer when you use personal information for the purposes of scientific research, including commercial scientific research. It clarifies that people can give “broad consent” to an area of scientific research.
Assumption of Compatibility
Similar to the changes to legitimate interest, in certain cases, personal data can be re-used without the controller having to complete an assessment. This includes disclosing personal information for the purposes of archiving in the public interest, even if you only got consent for a different purpose.
Automated Decision Making
One of the more significant divergence from the EU laws – automated decision making only applies where the decision is based entirely, or partly on special category data. The safeguards of human review and transparency will continue to be required for all solely automated decisions.
Privacy Notices
You can re-use people’s personal data for scientific research without giving them a privacy notice if the efforts are disproportionate. As long as you protect their data throughout and publish a privacy notice on your main website, the privacy notice does not have to be served directly.
