September 2026
What the UK’s new data law means for your business and your privacy compliance strategy
Author: Sam Honey
Key Contact: Declan Goodwin
Following our previous article, we take an in-depth look at how the Data Use and Access Act 2025 (DUAA) will reshape the UK's data protection regime, from automated decision-making to cookies and consumer rights.
A new phase of UK data governance
From 19 June 2025, the DUAA introduces a significant overhaul to UK data protection law. This new legislation simplifies compliance for businesses, supports innovation, and modernises data rights.
The DUAA amends the UK GDPR, the Data Protection Act 2018, and Privacy and Electronic Communications Regulations (PECR). Businesses in all sectors, especially those processing large volumes of personal data or deploying AI technologies, must adapt to this new framework.
Key changes: streamlined rules and stronger oversight
While the DUAA aims to reduce the burden on businesses, it also expands regulatory powers and clarifies long-standing "grey areas" in UK data law. This legislation reflects a risk-based, business-friendly shift, but one with clear responsibilities. Nine key changes stand out:
Simplified compliance for legitimate interests
The DUAA introduces a new list of "recognised legitimate interests," such as national security, responding to emergencies, and crime. Processing data for these interests no longer requires a balancing test. Ministers also have new powers to expand this list. If your processing falls within these categories, you will benefit from simplified compliance.
Loosened rules on automated decisions
Restrictions on solely automated decisions are looser now, especially for those with legal or similar significant effects. This doesn't apply when special category personal data is involved or the processing relies on recognised legitimate interests. Such decisions are now permitted if appropriate safeguards are in place, including the right to contest, human involvement, and transparent explanations. Companies using AI-driven tools for credit scoring, recruitment, or eligibility assessments gain greater legal certainty.
A clearer path for data subject access requests (DSARs)
The DUAA codifies certain elements of current ICO guidance regarding DSARs. For example, a search must only be "reasonable and proportionate." Also, the "clock is stopped" when a controller needs and asks for clarity on the DSAR's scope.
Stronger protections for children's data
The DUAA strengthens the Age Appropriate Design Code (AADC), requiring organisations to design online services with children's privacy in mind. If your service is likely to be accessed by under-18s, you must maintain high privacy settings by default, avoid profiling, and ensure data minimisation.
Simplified rules for low-risk cookies
Low-risk cookies, like those for analytics, site performance, or basic security—can be used without consent. This allows companies to simplify cookie banners for certain technical uses. However, marketing, tracking, and profiling cookies still require opt-in consent.
A new test for international data transfers
A new "data protection test" for UK transfers moves away from the EU-style "adequacy model." Instead of requiring "essential equivalence," the test asks whether protections in the recipient country are "not materially lower" than those in the UK. This marks a shift toward a more flexible approach, drawing on common law principles and risk-based governance.
Expanding categories of special data
The Secretary of State can now introduce additional categories of special category personal data, subject to Parliamentary approval. Ongoing monitoring of this power is essential to ensure continued compliance and anticipate any regulatory changes.
The foundation for smart data schemes
The DUAA lays the groundwork for smart data schemes across sectors. These frameworks will require businesses to share customer data through standardised APIs. This means firms in regulated sectors may need to build or adopt interoperable data-sharing systems.
Enhanced enforcement powers for the ICO
The ICO will have enhanced enforcement powers, including for PECR breaches. These are now subject to fines of up to £17.5 million or 4% of global turnover, which aligns with the UK GDPR. Marketing compliance must now be treated with the same seriousness as personal data.
What your company should do to prepare
To prepare for the DUAA, businesses should:
- Update privacy notices, lawful basis records, DSAR policies, and cookie banners.
- Review automated decision-making (ADM) systems: amend review mechanics and provide transparent notices.
- Evaluate children's services against the AADC and perform design audits.
- Prepare for smart data obligations if you operate in a regulated sector.
- Train staff on new DSAR thresholds and enforcement risks.
- Actively monitor legislative updates for any expansion of special category personal data by the Secretary of State.
- Track commencement regulations, expected over the next 2–12 months.
A proactive approach is key
The DUAA brings a more practical and flexible approach to data protection, without removing the need for good governance. By reviewing current practices and making a few targeted updates, your business can stay compliant and build trust with customers, partners, and regulators.
If you would like to discuss how the DUAA may apply to your business, please contact our Commercial and Technology team.
