Slough Office: Herschel House,
58 Herschel Street, Slough SL1 1PG
London Office: 10 John Street,
London WC1N 2EB
Slough Office: Herschel House,
58 Herschel Street, Slough SL1 1PG
London Office: 10 John Street,
London WC1N 2EB
The Data (Use and Access) Act 2025 (DUAA) received Royal Assent on 19 June 2025.
It does not replace the UK GDPR, the Data Protection Act 2018, or Privacy and Electronic Communications Regulations (PECR), but amends and supplements them to reduce friction, enable innovation, and facilitate data sharing, while seeking to preserve EU adequacy status.
Please see below a summary of the key changes and how they impact businesses.
The DUAA has softened the existing restrictions on decisions based solely on automated processing, provided special category data is not involved. It also allows controllers to rely on a wider range of lawful bases (including legitimate interests), subject to appropriate safeguards.
Safeguards retained:
The core protections remain in place as individuals still must be:
This change will allow businesses to make greater use of AI and automated tools in areas such as credit risk assessment, recruitment screening, and fraud detection (where special category data is not involved).
However, businesses will need to ensure transparency is properly addressed, and privacy notices and internal policies should clearly explain how automated decisions are made and what rights individuals have.
It would also be sensible to revisit DPIAs and internal risk assessments, particularly to distinguish between higher-risk and lower-risk uses of AI.
The DUAA introduces “Recognised Legitimate Interests” as a separate lawful basis under Article 6 UK GDPR. This applies to certain defined public interest purposes, including:
RLI came into force on 5 February 2026 and is expected to streamline compliance in a number of scenarios.
Where an RLI applies, businesses do not need to carry out the usual legitimate interests balancing test (although individuals retain their right to object).
This should reduce the administrative burden for relevant processing activities, and businesses should now review their processing activities to identify situations where RLI could be relied on instead of standard legitimate interests.
Any such changes will also need to be reflected in privacy notices and internal documentation.
The DUAA has effectively codified existing Information Commissioners Office’s (ICO) and EU Commission guidance. In particular, it confirms that (in relation to DSARs that a company receives):
This does not practically change anything as this guidance was always available to be utilised by businesses, however, inserting this guidance into the regulations will provides clearer rights so that businesses:
Despite the clearer rights, businesses should always document any decisions made relating to DSARs, particularly if there is a simultaneous issue or dispute (for example, if there is an employment claim that has led to the DSAR).
Individuals now have an explicit right to raise complaints directly with businesses, rather than going straight to the regulator, and businesses must implement a complaints-handling process, including acknowledgment and response requirements.
From 19 June 2026, businesses will be required to operate this formal complaints-handling process.
The key point is that businesses must ensure that complaints are:
In practice, this means putting in place clear internal procedures, updating privacy notices, and training staff to recognise and escalate complaints appropriately.
While this may lead to an increase in complaint volumes, many businesses are already dealing with complaints in this way as a matter of best practice.
In a nutshell, the threshold for adequacy (which allows UK businesses to transfer personal data to countries outside of the UK) and when a transfer risk assessment is needed has been reduced.
In particular, the ICO is now able to grant a company adequacy if the recipient countries laws have data privacy and protection that are not at a “materially lower” standard than in the UK, replacing the stricter “essential equivalence” test.
This gives the ICO greater flexibility when assessing other jurisdictions. For businesses, it should subsequently become easier to justify certain international transfers, particularly outside the EEA.
As a result, businesses should review existing transfer risk assessments to ensure they reflect this updated, more flexible standard.
Certain low-risk cookies (such as those used for analytics or functionality) no longer require consent.
PECR fines have also been significantly increased to align with GDPR levels (up to £17.5 million or 4% of global turnover, rather than the previous cap of £500,000).
In addition, the ICO have increased their ability to investigate concerns around, and issue penalties for “nuisance marketing”, which happens when businesses do not follow the rules for advertising (i.e spam or junk mail).
There is now an opportunity for businesses to simplify cookie banners and use better analytics to improve customer user experience. However, businesses will still need to assess carefully which cookies qualify as “low risk” and ensure that assessment is documented.
In addition, marketing practices (including email and SMS campaigns) should be reviewed as a result of the increased enforcement risk.
The definition of “scientific research” has been expanded to include certain commercial research activities, and the DUAA also relaxes some of the restrictions around consent, purpose limitation and the reuse of data for R&D-driven businesses.
This is particularly helpful for businesses involved in R&D as it allows greater flexibility to reuse personal data for research purposes, including commercial projects, even where that was not the original purpose of collection.
As a result, businesses can take a more pragmatic approach to data use in innovation-driven contexts.
The DUAA reinforces the need to consider and apply higher protection when collecting and using personal data about children, particularly if the business operates online services which are aimed at children.
While there are no major changes, businesses must be able to demonstrate that they have properly considered the risks.
This includes ensuring that:
Oury Clark can provide you with advice and support.
To find your nearest office or get in touch with one of our specialist advisors to see how we can help your business, please go to our contact page.
