The Data (Use and Access) Act [DUAA] received Royal Assent, and the ICO prepares to be replaced by the DPIA
23/06/2025
The UK Data (Use and Access) Act 2025 (the “DUAA”) received Royal Assent on June 19, 2025.
Implementing the Data (Use and Access) Act 2025 will be phased. Here’s a general timeline:
- Immediate Effect: Some provisions took effect immediately upon Royal Assent on June 19, 2025
- 2 to 6 Months: Most provisions are expected to come into force within two to six months
- Up to 1 Year: Certain provisions may take up to a year to be implemented
Separate commencement orders will detail the precise dates for each provision. For the latest guidance and timelines, it's advisable to monitor updates from the ICO (soon to be the Data Protection and Innovation Authority) [2].
The Act provides the ICO with new powers, including the ability to compel witnesses to attend interviews, request technical reports, and issue fines of up to £17.5 million or 4% of global turnover under PECR.
KEY POINTS
Here are some key points about the Act:
- Clarifies the use of personal information for research.
- Lifts restrictions on some automated decision-making.
- Sets out how to use specific cookies without consent.
- Allows charities to send electronic mail marketing without consent in specific circumstances.
- Introduces a new lawful basis of recognised legitimate interests.
ICO TO BE REPLACED
The Information Commissioner's Office (ICO) will be replaced by the Data Protection and Innovation Authority (DPIA) under the new Data (Use and Access) Act 2025
In line with the amendments introduced by the DUAA, the UK government also announced a recruiting campaign for seven non-executive members to the board of the new Information Commission, which the DUAA will establish.
GUIDANCE
The UK Information Commissioner’s Office (the “ICO”) published a comprehensive resource suite on the DUAA on the same day.
The resources include, among other things, a factual summary of the DUAA and an outline of the ICO’s plans to roll out new or updated guidance as the DUAA’s provisions gradually come into effect. Implementing these provisions will be staggered, with some likely taking up to 12 months.
GUIDANCE includes
- An outline of what the Act means for organisations. https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/
- An outline of what the Act means for law enforcement agencies. https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-law-enforcement-agencies/
- A detailed summary of the changes for data protection experts. https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-law-enforcement-agencies/
- Our new and planned guidance web page sets out what guidance to expect and when. https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-law-enforcement-agencies/
- An outline of how we will continue our regulatory work as the Act is implemented. https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-law-enforcement-agencies/
- A guide for the public on how the Act will affect them. https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-law-enforcement-agencies/
References
- UK organisations stand to benefit from new data protection laws - https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/06/uk-organisations-stand-to-benefit-from-new-data-protection-laws/
- UK: Data (Use and Access) Bill passes through Parliament - https://privacymatters.dlapiper.com/2025/06/uk-data-use-and-access-bill-passes-through-parliament/
- UK Data (Use and Access) Act 2025 Receives Royal Assent and ICO ...https://natlawreview.com/article/uk-data-use-and-access-act-2025-receives-royal-assent-and-ico-publishes-guidance
- DUA Act 2025: 15 key changes ahead | Data Protection Network https://dpnetwork.org.uk/dua-act-key-changes-ahead/
The Team
Meet the team of industry experts behind Comsure
Find out moreLatest News
Keep up to date with the very latest news from Comsure
Find out moreGallery
View our latest imagery from our news and work
Find out moreContact
Think we can help you and your business? Chat to us today
Get In TouchNews Disclaimer
As well as owning and publishing Comsure's copyrighted works, Comsure wishes to use the copyright-protected works of others. To do so, Comsure is applying for exemptions in the UK copyright law. There are certain very specific situations where Comsure is permitted to do so without seeking permission from the owner. These exemptions are in the copyright sections of the Copyright, Designs and Patents Act 1988 (as amended)[www.gov.UK/government/publications/copyright-acts-and-related-laws]. Many situations allow for Comsure to apply for exemptions. These include 1] Non-commercial research and private study, 2] Criticism, review and reporting of current events, 3] the copying of works in any medium as long as the use is to illustrate a point. 4] no posting is for commercial purposes [payment]. (for a full list of exemptions, please read here www.gov.uk/guidance/exceptions-to-copyright]. Concerning the exceptions, Comsure will acknowledge the work of the source author by providing a link to the source material. Comsure claims no ownership of non-Comsure content. The non-Comsure articles posted on the Comsure website are deemed important, relevant, and newsworthy to a Comsure audience (e.g. regulated financial services and professional firms [DNFSBs]). Comsure does not wish to take any credit for the publication, and the publication can be read in full in its original form if you click the articles link that always accompanies the news item. Also, Comsure does not seek any payment for highlighting these important articles. If you want any article removed, Comsure will automatically do so on a reasonable request if you email info@comsuregroup.com.
As well as owning and publishing Comsure's copyrighted works, Comsure wishes to use the copyright-protected works of others. To do so, Comsure is applying for exemptions in the UK copyright law. There are certain very specific situations where Comsure is permitted to do so without seeking permission from the owner. These exemptions are in the copyright sections of the Copyright, Designs and Patents Act 1988 (as amended)[www.gov.UK/government/publications/copyright-acts-and-related-laws]. Many situations allow for Comsure to apply for exemptions. These include 1] Non-commercial research and private study, 2] Criticism, review and reporting of current events, 3] the copying of works in any medium as long as the use is to illustrate a point. 4] no posting is for commercial purposes [payment]. (for a full list of exemptions, please read here www.gov.uk/guidance/exceptions-to-copyright]. Concerning the exceptions, Comsure will acknowledge the work of the source author by providing a link to the source material. Comsure claims no ownership of non-Comsure content. The non-Comsure articles posted on the Comsure website are deemed important, relevant, and newsworthy to a Comsure audience (e.g. regulated financial services and professional firms [DNFSBs]). Comsure does not wish to take any credit for the publication, and the publication can be read in full in its original form if you click the articles link that always accompanies the news item. Also, Comsure does not seek any payment for highlighting these important articles. If you want any article removed, Comsure will automatically do so on a reasonable request if you email info@comsuregroup.com.