ICO consults on legitimate interests and complaints handling
The ICO is revising some of its guidance on the new Data (Use and Access) Act 2025. In the first instance, the ICO is seeking comment on amendments to ‘recognised legitimate interest’ - a new lawful basis - and ‘data protection complaints for organisations’ guidance.
The upcoming guidance include:
- ‘Recognised legitimate interest’ which is a new lawful basis for handling personal information that is in the public interest which is separate from the legitimate interests lawful basis; and
- ‘Data protection complaints’ which is a new requirement for all organisations to have a process in place by June 2026 as the DUAA states that companies should first try to resolve complaints before going to the ICO.
The DUAA received Royal Assent on 19 June 2025 and most of the data protection provisions are expected to enter into force just before the end of 2025. The exception is the complaints process as it has been recognised that it may take organisations some time to organise their processes.
The consultation of recognised legitimate interests closes on 30 October 2025.
The consultation on handling complaints closes on 19 October 2025.
Privacy Laws & Business has organised, in cooperation with Linklaters, a half-day conference “Maximising opportunities from the Data (Use and Access) Act 2025”
Date: 1 October
Place: Linklaters, London
Time: Registration: 09.00 BST
In-Person Sessions: 09.30 to 14.20 BST
Virtual Sessions: 09.30 to 12.30 BST
Speakers announced so far: DSIT, The ICO, Linklaters and TikTok