Skip to content
The Information Commissioner’s Office (ICO) has begun consultations on two important changes coming into force under the new Data (Use and Access) Act 2025 (DUAA).
The consultations focus on:
- Recognised legitimate interest – a brand new lawful basis for handling personal information.
- Data protection complaints – new requirements for all organisations to have a process in place for handling complaints.
Recognised legitimate interest
This new lawful basis is separate from the existing “legitimate interests” ground and allows organisations to use personal information more confidently for certain pre-approved situations. These include:
- Crime prevention and public security.
- Safeguarding and emergencies.
- Sharing information to help another organisation carry out its public tasks.
The ICO will be providing detailed guidance and examples to help organisations apply this new lawful basis correctly. Public authorities, however, are expected to continue using the existing “public task” lawful basis.
The consultation on this area closes on 30 October 2025.
Data protection complaints
By June 2026, every organisation must have a process in place for handling data protection complaints. Complaints could come from anyone unhappy with how their personal information has been used.
The new Act requires organisations to:
- Give people a way of making data protection complaints to them.
- Acknowledge they have received a complaint within 30 days of receipt.
- Take appropriate steps to respond to a complaint, including making appropriate enquiries and keeping people informed, without undue delay.
- Telling people the outcome of their complaints, also without undue delay.
The ICO’s draft guidance explains the new requirements and what organisations must, should and could do to comply. Helpful tips and practical advice are included.
The consultation on this guidance is open until 19 October 2025.
What next?
Deputy Commissioner Emily Keaney emphasised the importance of these consultations: “These consultations provide us with a real opportunity to listen, learn and lead with clarity and we encourage all interested parties to engage with our consultations and help shape our final guidance to ensure it is robust and fit for purpose.”
Whether you plan to respond or not, reviewing the draft guidance could help you plan ahead for the June 2026 deadline as you assess whether you already have a clear process for handling complaints and, if not, what changes are needed.
