The Data (Use and Access) Act 2025 (DUAA) has officially become law in the UK, marking a significant shift in how personal and organisational data is used, accessed, and protected. After months of parliamentary debate, the Act received Royal Assent on 19 June 2025 and introduces new reforms with direct impacts on businesses, public services, and individuals.
The DUAA is designed to modernise the UK’s data framework post-Brexit. It updates key legislation such as the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR). It has a strong focus on promoting innovation, reducing administrative burdens, and supporting economic growth all while maintaining essential privacy protections.
Key Changes for Organisations
For businesses and organisations, the DUAA introduces greater flexibility in how personal data can be used:
• Scientific Research: It clarifies when and how personal data can be used for scientific research, including commercial research. Organisations can now rely on "broad consent" from individuals for research purposes and are allowed to reuse data for research without always having to issue new privacy notices, provided individuals’ rights remain protected.
• Automated Decision-Making: The Act expands the range of lawful bases organisations can rely on when making significant automated decisions about individuals, making it easier to implement AI-driven processes (subject to safeguards).
• Cookies: Some cookies used for analytics and website functionality will no longer require user consent, simplifying website compliance for businesses.
The DUAA introduces measures to reduce compliance complexity:
• Recognised Legitimate Interests: For certain public interest activities like crime prevention, organisations can process data without performing a detailed balancing test.
• Simplified Subject Access Requests: When responding to subject access requests, organisations now only need to conduct reasonable and proportionate searches.
• Easier Public Task Disclosures: Organisations can share personal data with public bodies like the police without having to determine if the request meets the public task requirement; the requesting body will carry that responsibility.
Benefits for Individuals The DUAA also delivers several tangible benefits to everyday citizens:
• Faster NHS Services: NHS staff will save over 140,000 hours annually in administrative tasks thanks to improved real-time data access across different NHS systems. This means quicker diagnoses and treatments for patients.
• Better Price Comparisons: Consumers will gain more control over their energy usage data, helping them use apps to compare utility prices more accurately and find the best deals on groceries and bills.
• Reduced Traffic Delays: The new National Underground Asset Register will give construction teams instant access to underground utility maps, dramatically speeding up roadworks and reducing traffic congestion.
• Easier Identity Verification: Certified digital identity providers will now be able to offer trusted verification tools, making it simpler for people to prove their identity online when renting properties or starting new jobs.
The DUAA also reshapes the UK’s data regulatory landscape. The Information Commissioner’s Office (ICO) will transition into the new Information Commission, with a modernised governance structure and expanded powers to ensure accountability and transparency in its operations.
Furthermore, the government has committed to publishing a progress report within six months on the Act’s impact, especially in relation to the use of copyright works for AI model training.
EU-UK Data Transfers The UK’s data adequacy decision from the EU, essential for the free flow of data between the EU and UK, has been temporarily extended until 27 December 2025. This gives the European Commission time to assess whether the DUAA’s changes continue to meet EU data protection standards.
For organisations, most DUAA provisions will be phased in between June 2025 and June 2026.
Need Support? If your organisation needs advice on how to adapt to the DUAA, or if you are concerned about your data rights as an individual, please contact our team for guidance.
