Skip to content
The Data (Use and Access) Act 2025 (DUAA) has now received Royal Assent, introducing significant updates to the UK’s data protection framework. The new law aims to make it easier for businesses to use personal data responsibly while encouraging innovation and economic growth.
While many of the changes are pro-growth, they also require action. Some provisions will come into force in two to six months, others within 12 months – so business will need to start preparing.
Key Changes Businesses Should Know About
The DUAA introduces several new rules and clarifications, including:
- Clearer rules on data use for research
- Relaxed restrictions on automated decision making in certain circumstances
- New rules around cookie use, allowing some use without consent
- New rights for charities to send certain marketing emails without prior consent
- A requirement to take the needs of children into account if online services are provided that they are likely to use
- A new legal basis called ‘recognised legitimate interests’ for processing personal data
- A requirement to have a formal complaints procedure for data protection issues
It also strengthens the powers of the Information Commissioner’s Office (ICO), including:
- The ability to compel witnesses to attend interviews
- Request technical reports
- Issuing fines under PECR of up to £17.5 million or 4% of global turnover
What You Should Do Now
The ICO has produced a guide for organisations on what the new Act means for them.
The guide reviews what’s changing, what’s been made easier, and the new requirements businesses need to meet.
The ICO is encouraging businesses to make themselves familiar with the changes, look at whether they are doing enough to satisfy the requirement to consider the needs of children, and start thinking about how they can help people to make complaints.
