Data (Use and Access) Act 2025 - Key provisions now in force
Review Package
The Data (Use and Access) Act 2025 (the ‘DUA Act’) received Royal Assent and became law on 19 June 2025. The Government subsequently issued the DUA Act (Commencement No. 6 and Transitional and Savings Provisions) Regulations on 5 February 2026 (the ‘Regulations’). These Regulations activate many key provisions of the DUA Act and introduce important updates to the UK GDPR and Data Protection Act 2018.
The DUA Act is one of the most significant reforms in UK data law since the UK GDPR came into force back in 2018, and acts to amend over 50 existing legislations (including the Freedom of Information Act 2000, the Data Protection Act 2018, the Environment Information Regulations 2004 and the UK GDPR) to simplify data protection requirements to help UK businesses to protect people’s data whilst simultaneously growing their products and services.
The Information team at Devonshires expect many of the changes to data protection law set out in the DUA Act and Regulations to directly impact organisations, including the following:
1. A new lawful basis for processing
The DUA Act introduces a new lawful basis for processing personal data: processing necessary for ‘recognised legitimate interests’. Unlike the existing ‘legitimate interests’ lawful basis, this new ground will not require data controllers to conduct a balancing test to determine if their legitimate interests are overridden by the data subject’s rights and freedoms.
2. Changes to Subject Access Request requirements
The DUA Act codifies existing Information Commissioner guidance, such as response timeframes for SARs, and importantly confirms that data subjects are only entitled to receive personal data found in a ‘reasonable and proportionate’ search by the data controller.
3. New rules on dealing with complaints
The DUA Act introduces new rules on the processes that data controllers must adopt when handling data complaints, including requirements for data controllers to have a formal complaints process and acknowledge complaints within 30 days.
4. A new Information Commission
The DUA Act abolishes the office of the Information Commissioner and transfers the Commissioner’s functions and property to the new Commission.
It is vital that organisations take due consideration of the changes brought in by the DUA Act and Regulations, updating their data processes and procedures accordingly.
The Information team at Devonshires is here to assist by way of our complete Data (Use and Access) Act Review Package.
Key contacts
Hetal Ruparelia
Partner
Georgia Maskell
Solicitor
Newsletter
Subscribe to receive regular insights and event invitations.
Contact
Devonshires Solicitors LLP 30 Finsbury Circus London EC2M 7DT
Follow us
