The Data Use and Access Act 2025 (DUAA) came into force in the UK on 19 June 2025, bringing both a relaxation of existing data protection requirements and introduction of new requirements. One of the most talked-about changes has been the introduction of “recognised legitimate interests” as a new lawful basis for processing. Despite being highly anticipated, this change has received mixed views; a welcome change in reducing administrative burden yet potentially underwhelming in its limited remit.

In practice, organisations across various sectors frequently rely on legitimate interests (depending on the processing) as a lawful basis to process personal data. Relying on this lawful basis requires the organisation to carry out a three-part legitimate interests assessment (LIA). The three prongs include (1) identifying a legitimate interest (2) demonstrating that the processing is necessary to achieve it, and (3) balancing the legitimate interest against the data subjects’ interests, rights and freedoms. For many organisations, the third prong is the trickiest in practice to balance.