New legislation to protect individuals’ personal information has recently been given Royal Assent, meaning it will soon be easier for companies to comply while also innovating their services and products.
The Data Use and Access Act 2025, or DUAA, includes provisions to empower the growth of digital verification services, a new National Underground Asset Register and new Smart Data schemes like Open Banking. It will not replace the existing UK General Data Protection Regulation – GDPR – but seeks to make changes to it to make the rules much simpler for organisations.
What changes are included?
The new Act lifts restrictions on some aspects of automated decision making, clarifies how people’s personal information can be used to carry out research and sets out how some cookies can be used without consent. It also allows charities to carry out email marketing without consent under certain circumstances.
It requires organisations to put in place a complaints procedure for data protection, meaning that they will have to ensure they have fully understood and implemented the changes. Companies may wish to consult a legal expert to check that they are complying with the new law. Legal advisers at a reputable London law firm such as https://www.forsters.co.uk/ can give useful advice.
The Information Commissioner’s Office has been given new powers under the Act, which include requesting technical reports, compelling witnesses to attend interviews and issuing fines to a maximum of £17.5m, or 4% of global turnover.
Next steps
The new law will be phased in, with most changes expected to come into force within two to six months, although some could take up to 12 months. Companies can prepare by familiarising themselves with the Act and the changes it will make to data protection law. Any organisation which has online services that are likely to be used by children should ensure that they are putting in measures to satisfy a new requirement which covers their needs.
They can also look at the changes around innovation, which should make things easier, and decide if they want to make changes to their processes.
