The UK Data (Use and Access) Act (DUAA) became law on 19 June 2025.
One of its stated aims is to ease compliance burdens on UK organisations by introducing greater flexibility and providing more practical options for managing personal data, without undermining individuals’ fundamental rights under existing laws.
From a compliance perspective, the new law will have limited impact on most organisations, although it is likely to require some updates and changes to some internal practices and current policies.
1 DSAR (Data Subject Access Requests): reasonable and proportionate searches
The DUAA has taken sections of the current ICO guidance and made these law.
Section 78 reiterates that organisations are required only to carry out reasonable and proportionate searches in response to DSARs.
This section is one of the few which is immediately in force.
Further ICO guidance to elaborate on what is expected will be issued later this summer.
2 Broadening scope of permitted ‘automated decision making’ (ADM)
Currently under the UK data protection framework, individuals have a general right not to be subject to decisions based solely on automated processing, including profiling, where such decisions produce legal or similarly significant effects.
The most far-reaching change introduced by the DUAA is the relaxation of these rules about where a “significant decision”, with legal or similar effects, can be made without meaningful human involvement – unless ‘special category’ data is involved (in which case, there are further specific rules and exemptions to apply).
Going forward, solely automated decision-making will not be prohibited, provided that appropriate safeguards are in place. Those safeguards include the right for individuals to:
- Make representations regarding the decision,
- Obtain meaningful human intervention, and
- Challenge the decision.
This change gives a wider scope for organisations to utilise AI technologies, which of course involve ADM, provided they are used in a way that respects individual rights
The ICO has announced plans to consult on a significant update to its ADM and profiling guidance in autumn 2025, aiming to publish a new statutory code of practice on AI and ADM next year.
3 New right to complain about data protection to organisations
There is a new statutory right for individuals (data subjects) to complain to an organisation (which is a ‘data controller’) about compliance with data protection laws.
For some time already, the ICO guidance has suggested that individuals should engage directly with organisations before complaining to the ICO. Now the DUAA introduces new obligations on organisations to facilitate the making of complaints (such as through complaints forms), acknowledge these within 30 days, and respond to the complaint ‘without undue delay’.
Many organisations will update privacy policies to inform individuals of this new right, and may also need to review internal complaint handling procedures to ensure timely acknowledgment and responses are issued.
Further guidance on this change from the ICO is scheduled for the winter of 2025.
4 Significant update to use of ‘cookies’
‘Cookies’ are small files, downloaded onto a computer or device when visiting a website. These are within scope of data protection laws as they involve processing of personal data about website visitors.
Automated technologies such as these are increasingly important to businesses, in particular when identifying prospective sales opportunities, analysing trends and marketing or advertising to generate income.
The DUAA introduces a detailed list of exceptions to basic prohibition on using cookies without an individual’s consent to store files on users’ devices.
New exceptions allow cookies without consent for
- strictly necessary functions (e.g., security, fraud prevention, authentication)
- statistical purposes to improve the service (provided an ‘opt-out’ is made available to users)
- website functionality enhancements (provided that a simple objection mechanism is made available to users)
- personalisation (which can automatically authenticate a repeat user of digital services or a repeat visitor to a website, and maintain a record of settings or preferences).
- In addition, cookies whose sole purpose is to ascertain a users’ locations in response to emergency communications will no longer require a users’ consent.
Clear consent requirements remain a requirement in all other situations, although now various mechanisms to collect this consent are permitted, including for example via browser settings. The amended rules now explicitly cover mobile applications and all information society service platforms, not only websites.
In practice, cookie bars or banners remain a legal requirement. But potentially there is more scope for businesses to rationalise and improve consent options used on websites, and boost how they use automated technologies to grow their business. Cookie policies will also need to be updated if introducing such changes.
It is important to keep in mind that the EU has not changed its requirements in relation to use of cookies, and so any UK businesses whose operations are subject to EU rules, as well as those in the UK, will need to comply with both regimes.
5 Direct marketing and cookie non-compliance: significant increases in potential fines
The DUAA significantly raises the maximum fines which can be imposed by the ICO.
Currently, maximum fines under the Privacy and Electronic Communications Regulations 2003 (PECR) are £500,000, whereas going forward any fines for breaches of cookie and direct marketing rules can be aligned with the UK GDPR’s much larger fine limits (up to £17.5 million or 4% of global turnover).
It is worth remembering that e-privacy compliance is already a key area of enforcement by the ICO, accounting for more than 90% of the fines imposed, and this is likely to continue.
Businesses at risk are those engaged in:
- email marketing
- SMS marketing
- cold calling, and
- using non-essential cookies on their websites.
6 Recognised Legitimate interests
Organisations are required to have a ‘lawful basis’ to use personal data.
The DUAA introduces a limited number of “recognised” legitimate interests, covering public interest purposes, such as responding to an emergency, investigating crime, and safeguarding vulnerable individuals.
Many businesses already use ‘legitimate interests’ as a lawful basis for these types of processing. In such cases, there is a requirement to carry out ‘behind the scenes’ compliance work (such as Legitimate Interests Assessments) which are not required when the business relies on a ‘recognised’ legitimate interest.
This change might be relied upon by, for example, financial services firms combatting or investigating fraud and other crimes, as well as organisations safeguarding individuals and retail businesses in relation to security.
The new law also includes a list of other types of processing which “may” count as legitimate interests – for direct marketing purposes, sharing data intra-group for internal administrative purposes, and ensuring security of network and information systems. The Secretary of State may add to the list in the future.
Organisations reviewing privacy policies ought to consider whether any of their current data processing activities are within scope of these new “recognised legitimate interests” and updating wording used in the privacy policy if appropriate to minimise unnecessary ‘behind the scenes’ compliance work.
ICO guidance on this new ‘recognised legitimate interest’ lawful basis is expected in the winter of 2025.
7 For charities only: permission to use ‘soft opt in’ for electronic direct marketing and fundraising
As a general rule, electronic marketing communications to individuals (for example, using email or text) can only be sent with the individual’s consent, which must have been obtained by that individual actively choosing to receive communications.
There has long been what might be described as an exception – described in guidance from the ICO as a “soft opt-in” – available to commercial businesses which market products and services to individuals who have either purchased or enquired about purchasing similar products or services.
Law on “soft opt-in” did not permit charities to rely upon it for sending electronic messages promoting their charitable purposes or when seeking donations from those who previously engaged with them. But the new DUAA extends the scope of the “soft opt-in” to include charities, which are now allowed to send electronic messages if:
- the sole purpose is furthering charitable purposes;
- contact details were obtained when recipients expressed interest in or supported those purposes; and
- recipients can easily opt out.
When do changes in the DUAA come into force?
Most of the changes described above are not yet in force (except for in relation to handling data subject access requests).
Reforms are likely to come into effect within the next six months, once additional regulations have been approved by the UK Secretary of State.
Any changes remaining are likely to come into force no later than within the next twelve months (i.e. before end of June 2026).
What do organisations need to do?
Compliance with the DUAA reforms will not be an onerous task, compared with the work required when the GDPR was introduced in 2018.
- All organisations should already be updating privacy policies periodically to ensure compliance. Where necessary, they ought to incorporate changes to remain in line with the new law – in particular, updating sections dealing with individual rights, which needs to include a right to complain directly to the organisation about data protection compliance.
- Organisations which already utilise ADM (automated decision making) or propose introducing AI tools ought to incorporate changes into their ‘behind the scenes’ data protection compliance work, for example updating data protection impact assessments.
- Internal complaints processes and procedures or templates used by staff may also need updating.
- Training for staff on data protection requirements should also be refreshed to ensure they are informed of relevant changes. Those responsible for compliance in HR, legal and data protection teams ought to keep an eye out for publication of updates to the ICO guidance also.
Free resources and guidance
The ICO has issued both high level and more detailed guidance on the DUAA reforms, and there is more guidance to come e.g. on complaints, data transfers, recognised legitimate interests and cookies (all scheduled for Winter 2025/26) and automated decision making (Spring 2026).
The UK Government has also published fact sheets on these changes
- Data (Use and Access) Act 2025: data protection and privacy changes – GOV.UK
- Data (Use and Access) Act factsheet: UK GDPR and DPA – GOV.UK
If you have any questions on any of the issues raised in this article, please contact Sean Morris