New Data (Use and Access) Act (The DUAA) — What to Do Next

The Data (Use and Access) Act 2025 (DUAA) has now received Royal Assent, introducing significant updates to the UK’s data protection framework. The new law is intended to make it easier for businesses to use personal data responsibly while encouraging innovation and economic growth.

While many of the changes are pro-growth, they also require action. Some provisions will come into force in two to six months, others within twelve months, so business will need to start preparing for these changes very soon.

What are the key changes?

The DUAA introduces several new rules and clarifications, including:

• Clearer rules on data use for research
• Relaxed restrictions on automated decision making in certain circumstances
• New rules around cookie use, allowing some use without consent
• New rights for charities to send certain marketing emails without prior consent
• A requirement to take the needs of children into account if online services are provided that they are likely to use
• A new legal basis called ‘recognised legitimate interests’ for processing personal data
• A requirement to have a formal complaints procedure for data protection issues

It also strengthens the powers of the Information Commissioner’s Office (ICO), including:

• The ability to compel witnesses to attend interviews
• Request technical reports
• Issuing fines under PECR of up to £17.5 million or 4% of global turnover

What you should do now…

The ICO has produced a guide about the Act, explaining what’s changing, what’s been made easier, and the new requirements businesses will need to meet.

The ICO is encouraging businesses to make themselves familiar with the changes, look at whether they are doing enough to satisfy the requirement to consider the needs of children, and start thinking about how they can help people to make complaints.

Find out more by following this link.