ICO highlights consultations on Data (Use and Access) Act 2025

The ICO has produced – and is consulting on – draft guidance to support organisations in understanding and applying upcoming amendments. These include ‘recognised legitimate interest’ (which is a new lawful basis separate from the ‘legitimate interests’ lawful basis) and ‘data protection complaints’ (which is a new requirement for all organisations to have a process in place for handling data protection complaints).  

These guidance pieces and consultations are a significant step in the ICO’s commitment to provide clear guidance on the amendments, which give organisations more confidence in handling personal information.

Deputy Information Commissioner Emily Keaney stated: “We understand the importance of providing businesses with the certainty they need in light of changes in the law. These consultations provide us with a real opportunity to listen, learn and lead with clarity. We encourage all interested parties to engage with our consultations and help in shaping our final guidance to ensure that it’s robust and fit for purpose.”

Consultation details 

‘Recognised legitimate interest’ is a new lawful basis. This new basis will give organisations greater confidence to use personal information for certain pre-approved purposes. These public interest purposes cover activities like crime prevention, public security, safeguarding, emergencies and sharing personal information to help other organisations perform their public tasks.

The ICO’s detailed guidance will make it easier for organisations to successfully use recognised legitimate interest by explaining how it works, along with giving practical examples. Public authorities should continue to use the public task lawful basis when using personal information for public tasks or official functions. Further details on the ten-week consultation, which closes on 30 October, can be accessed online.

By June 2026, organisations must have a process in place to handle data protection complaints. A complaint can come from anyone who’s unhappy with how an organisation has handled their personal information. The ICO’s guidance sets out the new requirements and informs organisations of what they must, should and could do to comply. Again, further details on the ten-week consultation, which closes on 30 October, can be accessed online.