The new UK Data (Use and Access) Act 2025 (“DUA Act”) received Royal Assent on 19th June 2025, bringing with it changes to UK data protection and e-privacy laws as we know them. For the first time since the introduction of the GDPR, UK privacy laws will notably deviate from EU laws.
What are the changes?
The key changes include:
- ICO reform – The Information Commissioner’s Office (“ICO”) will become the “Information Commission”, a statutory body like Ofcom. It will have new powers such as the ability to compel witnesses to attend interviews, request technical reports, and issue higher fines.
- Legitimate interests – certain data processing activities are “whitelisted” as an accepted legal basis for processing, including intragroup transfers of personal data for internal admin purposes, direct marketing and where protecting public security, meaning a legitimate interest assessment is not required.
- Research processing – the legal basis for processing personal data for research purposes has been extended. Data subjects can now give “broad consent” to processing for a general area of historical or scientific research and data controllers do not need to obtain consent again for the subsequent processing.
- Automated decision making – going forward automated decision making will only be prohibited where it relies on special category data. With appropriate safeguards applied, significant automated decisions can be made.
- International transfers
- adequacy of the export country will be assessed using a risk based approach. Transfers will be permitted if it is assessed that the standard of protection in the export country is “not materially lower” than in the UK. Note that existing international transfer agreements remain valid under new laws.
- the UK government will also be able to “blacklist” certain countries, in effect preventing businesses from transferring personal data there.
- Data subject complaints – data controllers should have a data protection complaints procedure. Much like an Ombudsman procedure, data subjects must raise a complaint with the controller first (which must be acknowledged within 30 days) before escalating it to the ICO.
- Data subject access requests – data controllers only need to carry out reasonable and proportionate searches and they are entitled to verify the requestor’s identity before responding (formalising the ICO’s guidance)
- Cookie collection – prior consent is now not required for cookies used to collect statistical data or those used to improve website functionality. However, users must be able to object to this at a later stage, which means cookie pop-ups are likely still needed for information purposes.
- Direct marketing by charities – charities may now rely on the soft opt-in exemption for direct electronic marketing where the marketing is to further the charitable objective, where the recipient already supports or has expressed interest in the charity. The data subject must be given the chance to object though.
- Fines for e-privacy breaches – fines for breaches of e-privacy rules under PECR are dramatically increased to align with those under the UK GDPR (i.e. 4% of global turnover or £17.5 million).
- AI – certain changes mentioned above mean that UK and EU laws on AI now differ with more flexibility under the DUA Act and with no AI-dedicated legislation yet introduced in the UK.
The DUA Act also brings in other regulations concerning smart data, digital verification services and IT standards for health records which we have not explored here.
When do the changes come into force?
Some provisions of the DUA Act came into force from the 19th June (such as concerning data subject access requests) but we have not yet been given a timeline for implementation of the majority of the changes.
What will this mean for data sharing with the EU?
The European Data Protection Board (“EDPB”) renewed the adequacy decision in favour of the UK recently, meaning organisations can continue to share/transfer personal data between the UK and EU countries without the need for additional cumbersome safeguards. However it was only renewed for 6 months, until 27 December 2025, in light of the impending advent of the DUA Act. Now that the DUA Act has become law, the EDPB, together with the European Commission (“EC”), will make a final decision before the end of the year as to whether to extend the adequacy decision for a longer period.
We hope that this will be the case, given the DUA Act has brought in only minor changes but the EDPB and EC may choose to make an example of the UK’s case… watch this space!
How should businesses prepare now?
As the DUA Act has not made any dramatic changes to data protection laws (particularly as compared to the original draft set out by the previous Government), we recommend not panicking. Instead, we suggest the following:
- Familiarise yourself with the ICO’s updated guidance on data protection, which can be found on their website.
- Ensure you are aware of the key changes (mentioned above) to ensure that your business will be ready to comply with them – some may affect certain businesses more than others.
- Privacy policies and other data protection-related policies will need to be updated with the new legislation titles.
- We would recommend checking cookie policies and website cookie consent, as well as direct marketing practices, given the new fining power under PECR.
- Any new contracts featuring data processing addendums or clauses should incorporate the new language too.
- Companies should look to implement a data protection complaints procedures.
If you would like further advice and guidance on the changes and how they might affect your business, please get in touch.
Madeleine Rhodes email: Mrhodes@redfernlegal.com
