It has been a month since the Data (Use and Access) Act 2025 (“DUAA”) received Royal Assent. DUAA amends existing UK data protection legislation, including, the UK GDPR, Data Protection Act 2018 and the Privacy & Electronic Communications (EC) Regulations 2003 (SI 2003/2426). Limited provisions came into force on the day DUAA was enacted, 19 June 2025. Its remaining provisions will come into force in the 12 months after enactment, and those dates will be specified in commencement regulations.
According to the ICO, “[DUAA] changes data protection laws in order to promote innovation and economic growth and make things easier for organisations, whilst it still protects people and their rights. Most of the changes offer you an opportunity to do things differently, rather than needing you to make specific changes to comply with the law”.
Reassuringly, therefore, if a UK organisation currently has a data protection compliance programme in place it can leverage that programme to accommodate the changes introduced by DUAA. Programme changes could, for example, be phased according to the commencement dates for applicable DUAA provisions (whenever these are published).
Follow our new DUAA series of blogs for regular, themed posts – first one next week will be on cookies!
Explore more insights
Articles 26 October
M&A due diligence: are you overlooking immigration risk?
Immigration is an important part of due diligence in M&As. Early identification of immigration issues can help buyers…
Events 14 October
Scaling with confidence: managing legal risk in a growing business
Growth creates exciting opportunities, but it can also expose a business to new and increasingly complex risks. Blake…
Articles 13 October
AIM Express Market route: a faster route to London for international companies
For international companies considering a secondary listing in London, the new AIM Express Market route could provide a…
