UK Data (Use and Access) Act 2025: A Comprehensive Overview | GDPR Amendment

The United Kingdom is updating its data protection laws with the Data Use and Access Act 2025 (DUAA), aiming to promote innovation and economic growth while still safeguarding individual rights. The act amends the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA), and the Privacy and Electronic Communications Regulations (PECR), but does not replace them.

Passed by Parliament, the DUAA introduces changes that will be phased in between June 2025 and June 2026. According to guidance published by the Information Commissioner’s Office (ICO), most of the changes are designed to offer organizations new opportunities rather than requiring them to take specific compliance actions.

Changes to Data Protection Laws

The DUAA focuses on several key areas to facilitate data use, particularly for research purposes. It clarifies when personal information can be used for scientific research, including commercial endeavors. A significant change allows individuals to provide ‘broad consent’ for their data to be used within a defined area of scientific research, streamlining the consent process.

The act also addresses the burden of privacy notices. Organizations will be permitted to reuse personal information for scientific research without providing a new privacy notice if doing so would be disproportionately difficult. However, What we have is contingent on protecting individuals’ rights through other means and publishing a general notice on their website explaining the data usage.

Promoting Innovation and Economic Growth

The ICO states that the DUAA is intended to help organizations innovate in several ways. The clarified research provisions are expected to encourage more data-driven scientific studies. The easing of privacy notice requirements for research aims to reduce administrative burdens and accelerate the pace of discovery.

Impact on Organizations

The changes brought about by the DUAA are largely intended to simplify processes for organizations. While some adjustments may be necessary, the ICO emphasizes that the act primarily offers new flexibilities rather than imposing new obligations. Many organizations will find they can operate more efficiently under the new framework.

Further reforms to UK data protection law took effect on February 5, 2026, as outlined by Hogan Lovells. These changes are being implemented through the DUAA 2025.

ICO Support and Preparation

The ICO is providing guidance and support to help organizations understand and prepare for the changes introduced by the DUAA. Organizations are encouraged to familiarize themselves with the new provisions and assess how they might benefit from the increased flexibilities. The ICO also offers resources to assist with compliance and data protection best practices.

As highlighted by Arnold & Porter, the DUAA represents the UK’s next chapter in data regulation, signaling a shift towards a more innovation-friendly approach while maintaining a commitment to data privacy.

Morgan Lewis notes that the Data (Use and Access) Act 2025 is a strategic update to UK data privacy regulations.