The Data (Use and Access) Act 2025 (DUAA) represents the most significant update to UK data protection law since the UK GDPR and Data Protection Act 2018.
The legislation received Royal Assent on 19th June 2025 and was introduced to modernise the UK’s data regime, support innovation, improve access to data and reduce unnecessary compliance burdens while maintaining strong protections for individuals. The reforms sit alongside the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR), rather than replacing them.
While some provisions took effect immediately following Royal Assent, the majority of the Act’s data protection reforms came into force on 5th February 2026. This means organisations should now be reviewing policies, procedures and governance arrangements to ensure they are operating in line with the updated framework.
What has changed?
Automated decision-making becomes more flexible
One of the most notable reforms concerns automated decision-making (ADM), including the use of artificial intelligence.
Previously, organisations faced tighter restrictions on decisions based solely on automated processing that produced legal or similarly significant effects. Under the DUAA, organisations have greater scope to use automated decision-making, provided they have implemented appropriate safeguards. These include informing individuals about significant automated decisions, allowing them to challenge decisions, enabling them to make representations and offering access to meaningful human review. Special protections continue to apply where special category data is involved.
For businesses embracing AI-driven processes, the changes create opportunities to improve efficiency while maintaining accountability and transparency.
Subject Access Requests are now clearer
The Act largely codifies existing guidance from the Information Commissioner’s Office (ICO) regarding Subject Access Requests (SARs).
Organisations are only required to carry out searches that are “reasonable and proportionate” when responding to requests. The reforms also clarify circumstances in which the response period may be paused while the requester is asked for additional information or clarification.
For employers and businesses dealing with large volumes of data, this provides welcome certainty and may reduce the burden associated with particularly broad requests.
Recognition of legitimate interests
The DUAA introduces the concept of “recognised legitimate interests”, creating situations where organisations can rely on legitimate interests as a lawful basis for processing personal data without carrying out a separate balancing test.
Examples include:
- Fraud prevention
- Safeguarding vulnerable individuals
- Crime prevention and detection
- Emergency response activities
- Certain public interest functions
This reform is aimed at simplifying compliance in circumstances where Parliament has already determined that the public interest in processing is clear.
Research and data reuse provisions
The Act introduces greater flexibility around scientific research, historical research, archiving and statistical purposes. It also clarifies the rules governing further processing and compatible use of personal data.
For qualifying research, fresh privacy information need not be provided individually where doing so is impossible or would involve disproportionate effort. Appropriate safeguards must still apply, and the privacy information must be publicly available.
Cookies and electronic marketing reforms
The reforms make it easier to use certain low-risk cookies, such as those used solely to collect statistical information to improve a website or service or to adapt its appearance or functionality without obtaining prior consent in every case. Transparency and free clear opt-out mechanisms must still be provided. Advertising tracking still requires consent.
However, organisations should not take this as a sign that enforcement is being relaxed. The Act significantly strengthens PECR enforcement by bringing maximum PECR fines into line with UK GDPR levels. Serious breaches can now attract penalties of up to £17.5 million or 4% of worldwide annual turnover.
New complaints handling requirements
One of the final major provisions to come into force was the requirement for organisations to establish a formal complaints process for data protection concerns.
Since 19th June 2026, organisations must provide a clear and accessible mechanism for individuals to raise data protection complaints before escalating matters to the regulator. Organisations must acknowledge complaints within 30 days and, without undue delay, investigate, keep individuals informed and communicate the outcome.
Businesses should ensure complaints are properly logged, investigated and responded to within appropriate timescales.
Stronger regulatory powers
The legislation also strengthens the powers of the UK’s regulator.
On 30th September 2026, the Information Commissioner’s Office became the Information Commission, but will continue to be known as the ICO (Information Commission’s Office). It has gained enhanced enforcement powers, including the ability to compel witness attendance, require technical reports and impose higher penalties under PECR.
Organisations should therefore expect greater regulatory scrutiny where serious compliance concerns arise.
What should businesses be doing now?
With the main reforms now in force, businesses should move beyond awareness and focus on implementation.
Practical steps include:
- Reviewing privacy notices and transparency information.
- Updating SAR procedures to reflect the reasonable and proportionate search requirement.
- Identifying processing activities that may rely on recognised legitimate interests.
- Reviewing AI and automated decision-making systems.
- Updating cookie policies and consent mechanisms.
- Implementing or reviewing data protection complaints procedures.
- Training staff on the new requirements.
- Assessing international data transfer arrangements.
- Preparing for enhanced regulatory oversight and enforcement.
Looking ahead
Although the majority of the DUAA reforms are now operational, further guidance from the Information Commission continues to emerge as organisations adapt to the new framework. The regulator has been publishing updated guidance covering areas such as Subject Access Requests, data protection by design and complaints handling, with additional guidance expected as implementation matures.
