The UK’s biggest update to data protection law since Brexit – and what your business should do next.
Is your business affected?
If your business:
- collects customer or employee information;
- sends marketing emails;
- uses cloud software such as Microsoft 365, Google Workspace or a CRM;
- uses AI tools;
- shares personal data with suppliers; or
- employs staff,
then the answer is almost certainly yes.
The Data (Use and Access) Act 2025 (DUA Act) is the most significant update to UK data protection law since the UK GDPR came into force following Brexit.
Although many of its provisions are being introduced gradually, businesses shouldn’t assume nothing needs to be done until every change is in force. The Act updates several important areas of UK data protection law and many organisations should now be reviewing whether their documents, policies and procedures still accurately reflect how they handle personal data.
What is the Data (Use and Access) Act 2025?
The DUA Act updates the UK’s existing data protection framework rather than replacing it.
It amends three key pieces of legislation:
- the UK General Data Protection Regulation (UK GDPR);
- the Data Protection Act 2018; and
- the Privacy and Electronic Communications Regulations (PECR), which govern electronic marketing.
The Government’s aim is to simplify parts of the law, encourage innovation (particularly around artificial intelligence and digital services), improve the way data is used across the economy and reduce unnecessary bureaucracy, while maintaining strong protections for individuals.
Some commentators have described the Act as an evolution rather than a revolution. That is largely true—but there are still several important changes that businesses should understand.
1. The rules around lawful processing have changed
One of the most important changes affects the legal reasons businesses can rely on when processing personal data.
Under the UK GDPR, every organisation must have a lawful basis before it collects or uses personal information. Depending on the circumstances, this may be:
- consent;
- performance of a contract;
- compliance with a legal obligation;
- protection of someone’s vital interests;
- carrying out a task in the public interest; or
- legitimate interests.
The DUA Act doesn’t replace these lawful bases, but it does clarify how some of them operate.
Greater certainty around legitimate interests
Many businesses rely on legitimate interests as their lawful basis for processing personal data.
The DUA Act now expressly confirms that legitimate interests may include activities such as:
- direct marketing;
- sharing information within a group of companies for internal administration; and
- protecting IT systems and networks from cyber threats.
While this doesn’t remove the need to consider whether legitimate interests are appropriate in each case, it provides greater certainty for businesses carrying out these common activities.
A new category: Recognised Legitimate Interests
The Act also introduces a new concept called Recognised Legitimate Interests.
Where one of these applies, organisations no longer need to carry out the usual balancing exercise between their interests and the individual’s rights.
Examples include processing necessary for:
- preventing or detecting crime;
- safeguarding vulnerable people;
- responding to emergencies; and
- certain public interest functions.
Although many SMEs may rarely rely on these provisions, businesses operating in regulated sectors, education, healthcare or safeguarding should understand when they may apply.
Action to take
Review whether your business:
- relies on legitimate interests;
- has completed Legitimate Interests Assessments (LIAs);
- accurately describes its lawful bases within its Privacy Notice; and
- has internal procedures that reflect how personal data is actually processed.
2. The rules on reusing personal data have been clarified
Businesses often collect personal data for one reason before later wanting to use it for another.
For example:
- contacting existing customers about similar services;
- analysing customer trends;
- improving products;
- developing AI tools; or
- carrying out internal research.
The DUA Act clarifies when personal data can be reused for a different purpose without obtaining fresh consent.
This should make the law easier to apply in practice, but businesses still need to understand when further processing is compatible with the original reason the data was collected.
Action to take
If your business regularly reuses customer or employee information for new purposes, review whether your Privacy Notice and internal procedures accurately explain how that information is used.
3. AI and automated decision-making
Artificial intelligence is rapidly becoming part of everyday business.
Many organisations now use AI to:
- screen CVs;
- analyse customer behaviour;
- generate marketing content;
- automate customer support;
- assess risk; or
- make recommendations.
The DUA Act relaxes some of the previous restrictions on automated decision-making, provided suitable safeguards are in place.
Individuals should still be able to:
- understand when important decisions have been made using automated systems;
- challenge those decisions; and
- request human involvement where appropriate.
Businesses adopting AI should ensure their policies and procedures keep pace with these developments.
4. Data Subject Access Requests (DSARs)
Anyone can ask your business what personal information you hold about them.
This is known as a Data Subject Access Request.
The DUA Act confirms that organisations only need to carry out reasonable and proportionate searches when responding.
For many businesses this reflects existing ICO guidance, but it now has a clearer statutory basis.
The Act also formalises aspects of the process for calculating response times and dealing with complex requests. We’ve published guidance on this as well.
Action to take
Ensure your staff know:
- how to recognise a DSAR;
- who is responsible for dealing with it; and
- how requests should be handled within the required timescales.
5. International data transfers remain important
Many SMEs transfer personal data outside the UK without realising it.
This often happens simply by using:
- Microsoft 365;
- Google Workspace;
- cloud accounting software;
- payroll providers;
- CRM systems;
- HR platforms; or
- overseas support providers.
The DUA Act simplifies aspects of the legal test for international transfers while maintaining safeguards for personal data.
If your business transfers personal information overseas, it is worth checking that your contracts and transfer documentation remain appropriate.
6. Smart Data schemes could change how businesses share information
One of the less-publicised parts of the DUA Act introduces a legal framework for Smart Data schemes.
If you’ve heard of Open Banking, you’ll already have seen a Smart Data scheme in action.
Open Banking allows customers to authorise banks to securely share financial information with approved third parties.
The Government intends to expand similar schemes into other sectors over time.
Potential future industries include energy and other markets where secure sharing of customer information could improve competition and make it easier for customers to compare products and switch suppliers.
For many SMEs this won’t create immediate obligations, but businesses developing software, digital platforms or customer-facing technology should monitor future developments.
7. Digital Verification Services (DVS)
The DUA Act also introduces a legal framework for Digital Verification Services.
These are trusted digital systems that allow individuals to prove things such as:
- their identity;
- their age;
- their address; or
- their right to work,
without relying solely on physical documents.
The Government is introducing an official trust framework and certification process for providers of these services.
Most businesses won’t become Digital Verification Service providers themselves.
However, employers and businesses carrying out identity verification may increasingly use Government-certified providers as digital identity becomes more common.
8. Your privacy documents may no longer reflect the law
Many businesses assume that once they’ve prepared a Privacy Notice and Data Protection Policy, the job is finished.
Unfortunately, compliance doesn’t work like that.
The DUA Act affects areas including:
- lawful processing;
- legitimate interests;
- reuse of personal data;
- automated decision-making;
- international transfers;
- complaint handling; and
- data subject rights.
If your documents haven’t been reviewed for some time, there’s a good chance they no longer accurately describe how your organisation processes personal data.
What should your business review?
The right documents will depend on your business, but commonly this includes:
- Privacy Notice;
- Employee Privacy Notice;
- Data Protection Policy;
- Data Retention Policy;
- Data Processing Agreements;
- International Data Transfer documentation;
- Staff procedures;
- Legitimate Interests Assessments; and
- AI governance procedures where relevant.
Don’t forget your contracts
Many businesses focus solely on updating their privacy documents.
However, data protection obligations are often contained within commercial contracts too.
For example:
- supplier agreements;
- customer terms and conditions;
- software development agreements;
- SaaS agreements;
- consultancy agreements; and
- data processing agreements.
If these documents haven’t been reviewed recently, they may no longer reflect current legal requirements or your business’s actual practices.
How Champion Law can help
Most businesses won’t need to start from scratch.
However, many will benefit from reviewing whether their documentation and procedures still reflect the law as it now stands.
At Champion Law, we help businesses stay compliant by reviewing and updating:
- Privacy Notices;
- Data Protection Policies;
- Employee Privacy Notices;
- Data Processing Agreements;
- commercial contracts;
- employment documentation; and
- wider compliance procedures.
For clients on our monthly retainers, we also help ensure their legal documentation evolves alongside changes in legislation, reducing the risk of documents gradually becoming outdated.
Final thoughts
The Data (Use and Access) Act 2025 isn’t simply another piece of legislation to file away.
It reflects the direction of travel for UK data protection law: greater clarity, increased flexibility for businesses, growing use of AI and digital identity, and a stronger emphasis on practical compliance rather than paperwork alone.
Now is a sensible time to ask a simple question:
Do our contracts, privacy documents and internal procedures still accurately reflect the way our business uses personal data today?
If you’re not sure, we’d be happy to carry out a review and identify what, if anything, needs updating. Simply get in touch.
