Data (Use and Access) Act Receives Royal Assent: What Changes for UK Data Protection

Changes to data protection law

The Information Commissioner's Office summarised the main data protection changes in its statement on Royal Assent:

• a new lawful basis of recognised legitimate interests;
• clarification of how personal information can be used for research;
• the lifting of some restrictions on automated decision-making;
• circumstances in which some cookies can be used without consent;
• permission for charities to send some electronic marketing without consent in certain circumstances; and
• a requirement for organisations to have a data protection complaints procedure.

The ICO also gains new powers, including compelling witnesses to attend interviews and requiring technical reports, and fines under PECR rise to up to £17.5 million or 4% of global turnover, matching the UK GDPR maximum.

Beyond data protection

The government highlights several wider measures. Certified digital verification services will be able to carry a trust mark, a change it expects to add £4.3 billion to the economy over ten years. Smart data provisions will let consumers share data such as energy usage with third parties for better comparisons. A National Underground Asset Register will map pipes and cables, and NHS patient information is to be accessible in real time across trusts, GP surgeries and ambulance services. A new Information Commission will replace the ICO as the UK's data regulator, with recruitment for its board under way.

When the changes apply

Most of the Data (Use and Access) Act is not yet in force. The ICO says the government will commence it in phases through secondary legislation, with most provisions expected to come into force either two or six months after Royal Assent and some taking up to 12 months. The ICO plans new guidance, consultations and practical tools over the coming months. The text is available on legislation.gov.uk.

What organisations should do

Controllers should map where recognised legitimate interests, the new research provisions or the relaxed automated decision-making rules could apply, set up a complaints procedure, review cookie banners against the new exemptions and reassess PECR marketing risk now that fines are much higher.

Sources

• GOV.UK: New data laws will make life easier for British people
• ICO: UK organisations stand to benefit from new data protection laws
• legislation.gov.uk: Data (Use and Access) Act 2025