Update: This article was originally published in 2025. For the latest position and the practical changes taking effect in 2026, read our updated article, “Data (Use and Access) Act 2025: 2026 Update”.
The Data (Use and Access) Act 2025 introduces significant changes across the UK’s data protection and wider data-use framework. Alongside amendments to the UK GDPR, Data Protection Act 2018 and PECR, the Act includes provisions relating to areas such as smart data schemes, digital verification services and the use and sharing of data across different sectors.
The Act received Royal Assent on 19 June 2025 and its provisions are being brought into force in stages. This means organisations need to consider not only which changes are relevant to their activities, but also when the individual provisions apply.
For those responsible for data protection, compliance and governance, the Act affects a range of areas, including automated decision-making, legitimate interests, data subject access requests, complaints handling, electronic marketing and cookies. Other provisions concern particular sectors or forms of data use.
This article provides an overview of some of the principal changes and the implementation position as understood at the time of its original publication in October 2025. For the subsequent position and changes taking effect in 2026, please refer to the updated article linked above.
What exactly is the Data (Use and Access) Act 2025?
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. It is a wide-ranging piece of legislation covering the use, access and sharing of data, as well as making changes to the UK’s existing data protection and privacy framework.
Rather than replacing the UK GDPR, Data Protection Act 2018 or Privacy and Electronic Communications Regulations (PECR), the Act amends the existing framework. Its provisions cover areas including data protection, digital verification services, smart data schemes, access to customer and business data, healthcare information standards and the National Underground Asset Register.
For organisations, the significance of the Act depends on the nature of their activities and the data they process. Some changes have broad relevance to organisations handling personal data, while others apply to particular sectors, services or types of data use.
Which organisations will be affected by these changes?
The impact of the Act varies depending on the organisation, the personal data it processes and the activities or services it provides. Some of the amendments to the UK data protection framework have broad relevance, while other provisions are directed at particular sectors or types of data use.
Organisations processing personal data may need to consider changes relating to areas such as automated decision-making, legitimate interests, data subject access requests and complaints handling. Organisations using cookies and similar technologies or carrying out electronic marketing may also be affected by changes to PECR.
Some provisions have a more specific application. These include measures relating to digital verification services, smart data schemes, health and social care information standards and the National Underground Asset Register. Certain online services may also need to consider provisions concerning children's personal data and access to information for research into online safety.
Charities may be particularly interested in the extension of the electronic marketing “soft opt-in” to certain charitable purposes, subject to the applicable conditions.
Organisations should identify the provisions relevant to their own activities rather than assume that every part of the Act applies to them.
Key changes to the data protection framework
Automated decision-making
The Act changes the UK GDPR rules governing solely automated decisions that produce legal effects or similarly significant effects for individuals. It distinguishes between decisions involving special category personal data and other significant automated decisions.
The changes provide greater scope for solely automated decision-making where special category personal data is not involved, but safeguards continue to apply. These include measures intended to provide individuals with information about significant automated decisions and opportunities to make representations, obtain human intervention and contest decisions.
Organisations using automated decision-making therefore need to understand whether their processing falls within the relevant provisions and ensure that the required safeguards are incorporated into their processes.
Scientific research and further processing
The Act provides greater clarity around processing personal data for scientific research. It clarifies that research may qualify as scientific research whether it is publicly or privately funded and whether it is carried out as a commercial or non-commercial activity, provided it can reasonably be described as scientific.
The Act also makes provision for consent to certain areas of scientific research where it is not possible to identify fully all of the purposes for which personal data will be processed at the time consent is given, subject to the relevant requirements and safeguards.
Changes also affect the circumstances in which personal data may be processed for research purposes and the information that must be provided to individuals. In particular circumstances, an exemption from the usual transparency requirements may be available where providing the information would be impossible or involve disproportionate effort, subject to the statutory conditions and appropriate safeguards.
Organisations relying on the research provisions should therefore consider the specific conditions that apply rather than assume that research activity is automatically exempt from the usual data protection requirements.
Recognised legitimate interests
The Act introduces the concept of “recognised legitimate interests” into the UK GDPR. For processing that is necessary for one of the specified recognised legitimate interests, organisations do not need to carry out the usual balancing exercise between their legitimate interests and the individual’s interests, rights and freedoms.
The specified purposes include certain processing necessary for national security, public security and defence, responding to requests from public bodies where specified conditions are met, safeguarding vulnerable individuals and responding to emergencies.
The Act also provides greater clarity around activities that may fall within the existing legitimate interests lawful basis. Examples include direct marketing, intra-group transmission of personal data for internal administrative purposes and processing necessary to ensure the security of network and information systems.
This does not mean that these activities automatically satisfy the legitimate interests lawful basis in every case. Where an organisation relies on ordinary legitimate interests rather than a recognised legitimate interest, it still needs to consider necessity and the balance between its interests and the individual’s rights and freedoms.
Cookies and similar technologies
The Act introduces changes to the rules governing cookies and similar technologies under PECR, including additional circumstances in which information may be stored or accessed on a user’s device without consent.
These include certain uses for statistical purposes and for improving or adapting the appearance or functionality of a service, subject to the relevant statutory conditions. Depending on the exception being relied upon, requirements may include providing clear information to users and giving them a simple means of objecting.
The changes do not remove the general requirement for consent for many non-essential cookies and tracking technologies. Organisations should therefore consider the purpose of each technology and the conditions attached to the relevant exception before changing their consent arrangements.
Data Subject Access Requests
The Act clarifies the approach organisations must take when searching for personal data in response to a data subject access request (DSAR). Organisations are required to make reasonable and proportionate efforts to locate the personal data covered by the request.
This provides greater statutory clarity around the extent of searches required, particularly where potentially relevant information is held across large volumes of records, systems or locations. It does not remove the need to identify appropriate data sources, understand the scope of the request and carry out searches that are reasonable and proportionate in the circumstances.
Where an organisation processes a large amount of information about an individual, the legislation also addresses when clarification may be sought to identify the information or processing activities to which the request relates.
For more on the practical management of requests, see our guide to Data Subject Access Requests.
Data protection complaints
The Act introduces specific requirements for organisations to facilitate complaints from individuals about the way their personal data has been handled. This includes providing an appropriate means for individuals to make a complaint, such as an electronic complaints form.
Organisations must acknowledge receipt of a complaint within 30 days and take appropriate steps to respond without undue delay. They must also keep the complainant informed about the progress of the complaint and its outcome.
Organisations should therefore consider whether their existing complaints procedures adequately cover data protection complaints, including how complaints are received, acknowledged, investigated, tracked and responded to.
Children’s data
The Act strengthens the emphasis on protecting children when organisations process personal data in connection with information society services that are likely to be accessed by children.
When considering the appropriate measures to protect children’s personal data, organisations must take account of how children can best be protected and supported when using the service. This includes recognising that children’s needs may differ according to their age and stage of development.
Organisations providing online services likely to be accessed by children should consider these requirements alongside the ICO’s Children’s Code, which provides guidance on designing online services with children’s privacy and data protection in mind.
When do these changes actually take effect?
The Act does not have a single commencement date. Its provisions are being brought into force in stages, with some taking effect on Royal Assent, others commencing automatically after a specified period and further provisions requiring commencement regulations.
At the time this article was originally published in October 2025, implementation was therefore still being phased. Different provisions had different commencement arrangements, making it important for organisations to establish when the particular changes relevant to their activities took effect.
Some provisions also have specific transitional or retrospective effects. Organisations should therefore consider the commencement arrangements for the individual provisions they are relying upon rather than treating the Act as having one overall implementation date.
For the current implementation position and the changes taking effect during 2026, see our Data (Use and Access) Act 2025: 2026 Update.
Preparing for phased implementation
At the time of the article’s original publication in October 2025, organisations needed to identify which provisions were relevant to their activities and monitor when those provisions would come into force.
A practical approach included reviewing existing arrangements in areas affected by the Act, such as automated decision-making, legitimate interests, data subject access requests, data protection complaints, cookies and electronic marketing, and children’s data where relevant.
Organisations could also consider whether existing policies, procedures, systems and records would need to be updated as individual provisions commenced, and identify who within the organisation was responsible for carrying out and approving those changes.
Where implementation involved several teams or workstreams, maintaining a clear record of relevant changes, responsibilities, actions and commencement dates could help organisations coordinate their response and monitor progress.
For the current position, including developments taking effect during 2026, see our Data (Use and Access) Act 2025: 2026 Update.
Practical support with data protection changes
Changes to data protection requirements can create a significant amount of practical work alongside an organisation’s existing responsibilities. Policies and procedures may need to be reviewed, information gathered from different teams, actions coordinated and implementation progress recorded.
Corporate Assist can provide additional capacity to support this practical work, working alongside existing Data Protection, Compliance, Governance, Legal and operational teams and any specialist advisers involved.
Support can include coordinating information, maintaining implementation and action trackers, supporting reviews of policies and procedures, collating responses from different teams and helping to keep implementation activity organised and documented.
Responsibility for interpreting legal requirements, determining how the legislation applies, making data protection decisions and approving the organisation’s response remains with the organisation and its appropriate specialist advisers.
If your organisation would benefit from additional capacity to support a data protection or compliance project, find out more about our Compliance & Risk Support or get in touch.
Share this post: