27 June 2025 – The UK government passed the Data (Use and Access) Act (DUAA), marking the most significant reform to UK data protection law since Brexit. While the UK GDPR and DPA 2018 remain intact, the DUAA introduces streamlined provisions for automated decision-making, subject access requests, international data transfers, and cookie consent. Notably, the Act allows certain low-risk storage technologies to operate without explicit user consent and introduces a “stop-the-clock” mechanism for SARs. It also empowers the ICO to evolve into the Information Commission (IC), with expanded investigative powers. These changes aim to reduce compliance burdens while maintaining high privacy standards. Businesses must now reassess their data handling practices, especially around ADM and legitimate interest processing.
Read the full article on: Data (Use and Access) Act 2025: data protection and privacy changes
✅ What it means for your business: The DUAA 2025 introduces new compliance expectations for UK businesses, especially around automated decision-making (ADM), subject access requests (SARs), and cookie consent. If your business uses AI, handles customer data, or relies on international transfers, you’ll need to update your privacy policies, conduct fresh DPIAs, and possibly revise your lawful basis for processing. The ICO’s transformation into the Information Commission also means more proactive enforcement.
🛡️ How it can be prevented in your business: Stay ahead by regularly reviewing ICO guidance and legislative updates. Conduct Data Protection Impact Assessments (DPIAs) for any automated decision-making or profiling tools you use. Update your privacy notices to reflect new lawful bases and ensure SAR workflows are efficient and documented. If you transfer data internationally, implement Standard Contractual Clauses (SCCs) or the UK’s International Data Transfer Agreement (IDTA). Embed privacy-by-design into all new systems and services.
Leave a Reply