UK organisations stand to benefit from Data (Use and Access) Act 2025

Changes to the law include clarifying how personal information can be used for research, lifting restrictions on some automated decision-making, setting out how to use some cookies without consent, allowing charities to send people electronic mail marketing without consent in certain circumstances, requiring organisations to have a data protection complaints procedure and introducing a new lawful basis of recognised legitimate interests.

The Act of Parliament provides the Information Commissioner’s Office (ICO) with new powers, including the ability to compel witnesses to attend interviews, request technical reports and issue fines of up to £17.5 million or 4% of global turnover under the Privacy and Electronic Communications Regulations.

Information Commissioner John Edwards stated: “The Data (Use and Access) Act 2025 affords organisations using personal information new and better opportunities to innovate and grow in the UK and further enhances our ability to balance innovation and economic growth with strong protections for people’s rights.”

Edwards added: “We’ve published a catalogue of resources to help explain what this new legislation means for businesses. Over the coming months, we will launch new guidance, open consultations and provide practical tools to help embed the Act’s principles into everyday operations. Our goal is to ensure that data can be used confidently and responsibly to deliver better services, drive economic growth and uphold public trust.”

Next steps for organisations 

Government will phase implementation of the new law, commencing different changes using secondary legislation. While most provisions are expected to come into force either two or six months subsequent to Royal Assent, some may take up to 12 months.

In order to prepare, organisations can: 

*familiarise themselves with the changes that the Data (Use and Access) Act 2025 makes to data protection law using these resources

*start thinking about how they can help individuals to make complaints 

*review the changes that support innovation and make things easier and consider whether they want to take the opportunity to do anything differently or streamline their processes

Raising concerns

The Law Society of England and Wales welcomes the Data (Use and Access) Act 2025’s impetus to modernise data use, but remains “concerned” over data protection, legal safeguards and data adequacy.

The Act of Parliament makes it easier to share information for public services like the NHS and gives businesses better access to data to improve services and customer satisfaction. However, checks and balances “must be able to ensure privacy protections” and notably so in relation to personal data.

According to The Law Society, more clarity is needed around how Artificial Intelligence (AI) and tech companies can use copyrighted content without permission. The Law Society recently had the opportunity to respond to the Government’s Copyright and AI consultation to address this issue.

Law Society CEO Ian Jeffery said: “The new Act affects the legal sector by updating rules around data compliance, privacy and data adequacy. The Act supports innovation, but there must be safeguards and protections for using personal data and publicly available content.”

Jeffery added: “The Government needs to ensure that the UK retains its European Union data adequacy decision so that data continues to flow smoothly. This is crucial to provide confidence to UK businesses, lawyers and clients and ensure that England and Wales remain the global jurisdiction of choice.”

In conclusion, Jeffery said: “Wider data considerations still to be debated, including copyright rules and AI regulation, should aim to protect and benefit the public, fairly balancing the interests of content creators and tech developers alike.”