UK Data Use and Access Act (DUAA)

Reforms UK GDPR and the DPA 2018: recognised legitimate interests, relaxed automated decision-making rules, new complaints-handling duty (from 19 June 2026), smart data and digital verification schemes, and the ICO becomes the Information Commission. Main data protection provisions commenced 5 February 2026.

JurisdictionUnited Kingdom
CategoryPrivacy & Data Protection
StatusPhased
Effective date
Latest development

Analysis

The Data (Use and Access) Act 2025 (DUAA) is a UK Act that amends UK GDPR, the Data Protection Act 2018 and PECR, introducing more flexible accountability, smart data schemes, digital verification services and updated automated decision‑making rules.Data (Use and Access) Act 2025Data (Use and Access) Act 2025: data protection and privacy changesData (Use and Access) Act 2025 | ICO

Below is a structured, compliance‑oriented analysis of DUAA aligned with your requested sections.

Key Requirements

According to the UK government and ICO, DUAA does not replace UK GDPR, DPA 2018 or PECR but changes and supplements them in several core areas.Data (Use and Access) Act 2025: data protection and privacy changesData (Use and Access) Act 2025: factsheetsThe Data Use and Access Act 2025 (DUAA) – ICO summary

1. Changes to lawful bases and “recognised legitimate interests”

2. More flexible accountability and documentation duties

3. Updated rules for automated decision‑making

4. Smart Data schemes and data sharing frameworks

5. Digital verification services

6. Subject access requests (SARs) and time limits

7. Complaints handling and ICO‑facing obligations

8. Cookie and PECR adjustments

9. Children and online services

Compliance Challenges

DUAA’s more permissive and flexible framework still creates practical compliance challenges for organisations adapting existing UK GDPR programs.The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations?Data (Use and Access) Act 2025: data protection and privacy changesData (Use and Access) Act 2025 - Wikipedia_Act_2025)

1. Interpreting “recognised legitimate interests” and new lawful grounds

2. Managing automated decision‑making safeguards in practice

3. Aligning Smart Data and digital verification with privacy controls

Recent developments

  • — Several further DUAA provisions, including the new statutory **“right to complain” directly to controllers/employers**, are scheduled to come into force on 19 June 2026, requiring organisations to implement internal complaint-handling mechanisms.[6] (source)
  • — Section 138 DUAA amending the Sexual Offences Act 2003 to criminalise the creation of **deepfake intimate images without consent** took effect on 6 February 2026, expanding criminal liability around harmful AI-generated content.[3] (source)
  • — Key DUAA provisions on **automated decision‑making, cookies, recognised legitimate interests and PECR fines** entered into force on 5 February 2026 via Commencement Regulations, narrowing the ADM prohibition to significant decisions involving special category data and raising PECR fines to UK GDPR levels.[3] (source)
  • — Employment-focused analysis highlights that DUAA changes to **legitimate interests, DSAR “stop the clock”, ADM, international transfers and the upcoming right to complain** are now in force or imminent, prompting employers to revisit privacy notices, DSAR procedures and transfer assessments.[6] (source)
  • — Sector commentary explains that DUAA both **tightens rules (e.g. new rights, PECR fines, ADM) and reduces red tape**, codifying ICO guidance on DSARs, clarifying research uses and introducing recognised legitimate interests, meaning organisations must update compliance programmes but may benefit from greater flexibility and clarity.[4] (source)
  • — The main data protection provisions of the Data (Use and Access) Act 2025 commenced; the complaints-procedure duty follows on 19 June 2026. (source)
  • — Alston & Bird’s January 2026 note outlines DUAA’s **phased implementation through 2026** and stresses impacts on UK GDPR (DSARs, ADM, legitimate interests, recognised legitimate interests, research provisions), advising controllers to plan for staged compliance changes rather than a single “big bang” transition.[4] (source)
  • — The ICO guidance “What does it mean for organisations?” explains that DUAA’s changes to **research, ADM, cookies and complaints** are intended to promote innovation and economic growth while protecting rights, and emphasises that most changes are opportunities to “do things differently” rather than imposing entirely new burdens.[5] (source)
  • — ICO’s DUAA overview confirms all **provisions affecting data protection law and PECR are now in force or being phased in between June 2025 and June 2026**, and positions the Act as an update to digital information law focusing on responsible data use and access.[1] (source)
  • — Morgan Lewis describes DUAA as the most significant UK data protection reform since UK GDPR, detailing **recognised legitimate interests, expanded scientific research definition, relaxed cookie consent for nonintrusive analytics, DSAR handling reforms and a new “not materially lower” test for international transfers**, with industry seeing both compliance challenges and operational benefits.[2] (source)
  • — Background coverage notes that DUAA, which became law on 19 June 2025, is being **implemented gradually from August 2025 onward**, with staged commencement of its amendments to UK GDPR, the Data Protection Act 2018 and PECR influencing privacy and data protection practice across UK industries.[7] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates