Implementing the Data Use and Access Act 2025

Introduction

Implementing the Data Use and Access Act 2025 (DUAA) first means having a working understanding of what the Act is and how it applies to your business. It is important to know that the DUAA does not replace any of the UK’s existing data protection laws or regulations. Instead, the Act amends the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA) and the Privacy and Electronic Communications Regulations (PECR).

The Act has been designed to align with the economic growth of the UK and aid innovation, whilst still protecting the rights of individuals. Instead of requiring large scale changes in how a business approaches and complies with existing data protection laws, the DUAA sits alongside current legislation. It enables companies to make specific, direct changes that protect personal data whilst still supporting a business framework.

DUAA Overview

The DUAA amends and updates certain regulations and guidelines contained in the existing data protection laws. Some of the Act amendments are only relevant to specific areas of data processing or industries. These include making research provisions easier to apply and clearer to understand and soft opt-in for charities.

However, there are also a few general updates and amendments that apply to all those processing personal data. These include, but are not limited to: –

Specific lawful bases for using automated decision-making.
a list of recognised legitimate interests for use as a lawful basis have been published for certain processing activities.
Certain cookies can be used without first gaining consent (i.e. for statistical purposes and improving website functionality).
The assumption has been added that some re-uses of personal information allowed without having to do a compatibility test if they are compatible with the original purpose it was collected it for.
A ‘soft opt in’ has been included for charities to allow the sending of electronic mail marketing to people whose personal information has been collected for specified reasons.
Clearer information on subject access requests (SARs) and when reasonable and proportionate searches are required.