The Data (Use and Access) Act (DUAA) 2025 was enacted on 19 June 2025 with the aim of making it easier for businesses in the UK to develop products and services while ensuring a high standard of rights for individuals regarding their personal data.

Changes to the law: The ICO lists changes to the law including:

1. Clarifying how personal information can be used for research
2. Lifting restrictions on some automated decision making
3. Setting out how to use some cookies without consent
4. Allowing charities to send people electronic mail marketing without consent in certain circumstances
5. Requiring organisations to have a data protection complaints procedure
6. Introducing a new lawful basis of recognised legitimate interests