- within Insurance, Strategy, Litigation and Mediation & Arbitration topic(s)
- in United States
- with readers working within the Insurance industries
The Data (Use and Access) Act 2025 (DUAA) received Royal Assent on 19 June 2025, modernising the UK's data protection framework.
While much attention has focused on subject access requests (SARs) and complaints processes, the Act's research provisions offer universities transformative opportunities.
How universities can maximise data value
The Act formally defines "scientific research" as "any research that can reasonably be described as scientific, whether publicly or privately funded, or conducted commercially or not". This removes ambiguity about research collaborations with industry or privately-funded studies.
The DUAA waives the compatibility test for research uses. If you're re-using data for scientific research or statistical purposes, that re-purposing is deemed compatible. This streamlines data sharing between projects and institutions, helping universities maximise dataset value for new research.
Researchers can now seek broad consent from participants for research purposes not fully determined at data collection. This flexibility helps universities conduct longitudinal and exploratory research without constantly re-consenting participants for each new sub-study.
You'll need to meet strict requirements for 'appropriate safeguards' as set out in the new Article 84C. The Secretary of State may subject those safeguards to further regulation.
Where to focus your attention
The legal environment is now more research-friendly, with less red tape around using data. Research offers universities the biggest benefits from these changes, so university leaders should focus their attention here.
ICO consultation on the research provisions
The Information Commissioner's Office (ICO) will consult on research under the new Act, with guidance to reflect the DUAA changes to research expected in "Winter 2025/26". This consultation will be the sector's opportunity to shape how the research provisions are interpreted and implemented in practice.
You need to be ready to actively participate when this consultation happens. Universities and the health sector stand to benefit most from these legal changes. If the guidance is too cautious, it could undermine what the Act is trying to achieve. If there's not enough guidance, or it's vague, particularly on what constitutes 'appropriate safeguards', you won't know how to use these new powers.
EU GDPR compliance will be a continuing obligation
You may still need to comply with the EU GDPR. The DUAA applies to the UK GDPR framework, but institutions with a presence in the EU, those offering services to individuals in the EU, or those monitoring EU data subjects' behaviour will remain subject to the EU GDPR alongside UK law.
Where both regimes apply, you'll need to comply with the stricter requirements. The EU GDPR doesn't include the same broad consent provisions or compatibility presumptions for research that the DUAA introduces to UK law. If you're engaged in international research collaborations, conduct a thorough jurisdictional analysis for each research project. This dual compliance obligation shouldn't overshadow the significant opportunities that the DUAA creates for UK-based research activities.
Next steps
Get ahead of this: even while waiting for different parts of the Act to commence, begin looking at how these changes might affect your planned research projects.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
