The UK's major post-Brexit reform of the UK General Data Protection Regulation (UK GDPR), the Data Use and Access Act (DUAA), became law on 19 June 2025.
The DUAA had a long gestation in the form of two previous draft laws, the Data Protection and Digital Information Bills No. 1 and 2, the second of which failed when the UK general election 2024 was called. The new government resurrected most elements of the previous proposals as the DUAA.
The UK Information Commissioner's Office has published guidance on the effects of the DUAA for businesses, but some of the more eye-catching changes include:
- Of particular interest to businesses considering AI solutions – the removal of restrictions on use of personal data for automated decision-making, as long as there are some safeguards in place.
- Consent no longer required to set statistical and functionality cookies.
The wider impact of the DUAA on UK–EU data transfers remains to be seen, with the EU due to review its UK adequacy decision by the end of 2025. However, as the EU has announced its own intention to reform the GDPR, more change could be on the way.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
