The Data (Use and Access) Bill brings UK GDPR reform

The path to the UK’s updated data framework has been drawn out and marked by political shifts. The Conservative government initially put forward the Data Protection and Digital Information Bill (DPDI) twice, but both versions were derailed most recently during the final rush of legislation before the general election. One year after, on 23 October 2024, the Labour government introduced the Data (Use and Access) Bill. While clearly inspired by the DPDI, the Bill left out several of the more controversial provisions.  

The Bill has successfully passed through the Houses of Parliament and received Royal Assent on 19th June 2025 to become the Data (Use & Access) Act 2025 (Act). The passage of the Bill followed a long and intense “ping pong” process between the Houses of Parliament due to a debate on greater transparency around the use of copyrighted material and data scraping to train AI models. Despite several proposed amendments, including requirements for disclosure and regulation of text and data mining, these were ultimately rejected. The government argued that the Bill was not the right forum to address such complex issues, especially while a separate consultation on AI and copyright is ongoing.  

The Act introduces a wider package of measures aimed at modernising the UK’s broader data and digital infrastructure. Among others it establishes a legal framework for certified digital identity and attribute service providers and lays the groundwork for smart data schemes in sectors like energy, finance, and telecoms. However, this article focuses specifically on the reforms to the UK General Data Protection Regulation (GDPR) and the Privacy and Electronic Communications Regulations (PECR), areas most directly impacting data protection compliance across sectors.  

The article outlines the key provisions of the Act and explains their practical implications, offering clarity for data controllers navigating the upcoming regulatory changes. Organisations should now turn their attention to preparing for implementation. Taking proactive steps at this stage will be essential for a smooth transition and ongoing compliance once the legislation comes into full force. 

Key amendments of the Bill 

Article 22 and Automated Decision-Making 

The Act introduces a major update to the UK’s rules on automated decision-making, replacing the existing Article 22 of the UK GDPR with a new structure made up of Articles 22A to 22D. These reforms aim to offer a more adaptable framework than the UK GDPR by relaxing controls over decisions involving standard personal data, while maintaining stricter rules for processing special category data. The Act also adds clarity through new legal concepts like “significant decision” and “meaningful human involvement.” A decision will now be treated as fully automated if no real human input is involved, especially where profiling is used, meaning organisations must demonstrate active human oversight to avoid falling under the stricter rules. 

When it comes to special category data, such automated decisions are only permitted if one of three criteria is met: explicit consent from the individual, necessity for fulfilling a contract combined with a substantial public interest under UK law, or a specific legal requirement. In addition, Article 22C imposes mandatory safeguards for all significant automated decisions-regardless of the data type. These include informing individuals, offering a way to challenge decisions, and ensuring access to human review.  

Lastly, the Act also empowers the Secretary of State to define what qualifies as meaningful human involvement or a significant impact and to establish minimum requirements for the safeguards that must be in place.  

Legitimate Interests 

The Act introduces a new list of “recognised legitimate interests” where data controllers no longer need to carry out a balancing test before processing data. These interests include activities like fraud prevention, network security, ensuring compliance with laws, and improving public services.  

The Act also identifies a supplementary set of processing activities that can potentially be justified under the current legitimate interest basis. Although these activities are not formally designated as “recognised legitimate interests” and still demand a Legitimate Interests Assessment (LIA), the legislation offers greater clarity and reassurance for businesses choosing to rely on this lawful basis. Examples of such activities include direct marketing, internal data sharing within corporate groups for administrative tasks, and maintaining the security of networks and information systems.  

International data transfers 

The European Commission has extended the UK’s current adequacy decision until the end of 2025 to allow time to assess the impact of the Act on cross-border data transfers. One of the more notable changes introduced by the Act is a shift in the test used to assess whether a third country offers an acceptable level of data protection. Under the new regime, the Secretary of State may determine adequacy based on whether the protections in the receiving country are “not materially lower” than those in the UK departing from the current “essentially equivalent” standard. This more flexible threshold has attracted attention, given its potential implications for international data flows and regulatory alignment with the EU. 

Scientific Research and Public archiving 

The Act expands the scope of what qualifies as scientific research, now including any research that can be reasonably described as scientific regardless of whether it is commercially or non-commercially driven, or publicly or privately funded. Additionally, individuals will be able to give consent for their data to be used in scientific research even when the specific purpose of the research is not yet fully defined. 

Alongside this, provisions for public archiving have been strengthened, ensuring that data preserved for historical, statistical, or research purposes is appropriately protected but accessible under clear legal frameworks. 

Data Subject Rights and complaints 

The Act effectively codifies much of the Information Commissioner's Office (ICO)’s existing guidance on handling Data Subject Access Requests (DSARs), meaning that, for many organisations already adhering to this guidance, day-to-day processes will see minimal disruption.  

The Act offers additional reassurance to controllers handling DSARs by establishing that data subjects are entitled only to personal data and related information that can be found through a reasonable and proportionate search. This provision provides controllers with a legal basis for setting clear boundaries around the extent of their searches, moving beyond mere regulatory guidance. 

A notable amendment introduced by the Act is where an organisation withholds information on the grounds of legal professional privilege.  In this case, the organization will be required to clearly inform the data subject about the specific exemption relied upon, and the rationale for its application. 

Also, under the new framework, individuals will gain a clearer right to raise concerns about how their personal data is handled. Organisations will be expected to have accessible and transparent procedures in place, such as providing a complaint form to enable individuals to submit complaints easily. Controllers must respond within 30 days. In addition, organisations may be required to report to the Information Commission the volume of data protection-related complaints they receive over a given period, adding a layer of regulatory oversight to complaint handling practices. 

Enhanced protection for children’s’ rights 

The Act introduces specific requirements to safeguard children’s data, defining anyone under 18 as needing enhanced protection. Organisations providing online services likely accessed by children must implement tailored technical and organisational measures that consider children’s unique needs at different ages.  

Cookies and Consent 

The Act updates the rules on cookies and similar tracking technologies, easing consent requirements in certain cases. It allows the use of non-essential cookies without consent when used solely for purposes like gathering statistics to improve site performance, adapting content to user preferences, or enhancing services. The Act also provides a defined list of cookie uses considered strictly necessary, such as for security and fraud prevention where consent and opt-out options are not required. 

Extension of soft opt-in 

The Act also amends PECR to extend the soft opt-in for email marketing to charitable organisations. Under this change, charities are permitted to send direct marketing emails to individuals who have previously donated or shown interest in their activities, provided those individuals are clearly informed of their right to opt out and are given a simple means to do so at any time. 

PECR breach penalties raised to GDPR Standards 

Fines for breaches of PECR will be raised to GDPR-level penalties under the new regime. The Information Commission - which will replace the ICO - will gain strengthened enforcement powers, including the authority to impose maximum fines of up to £17.5 million or 4% of annual global turnover, whichever is greater, for violations of PECR rules such as those related to cookies. This represents a substantial increase from the current maximum fine of £500,000 for PECR breaches.  

Information Commission Reform 

The Information Commissioner's Office (ICO) will transition to a restructured Information Commission, governed by a statutory board. This new model aims to increase transparency, promote innovation, and ensure consistent enforcement.  

Required actions from organisations 

• Update your practices to reflect changes regarding the automated decision-making rules, including the introduction of “meaningful human involvement” and the distinction between personal and special category data. 
• Ensure your records of processing activities reflect new lawful bases, particularly where changes relate to legitimate interests, scientific research, or data sharing under the updated framework. 
• Re-evaluate current mechanisms for transfers outside the UK in light of the new “not materially lower” test. Stay informed about the adequacy review by the European Commission and maintain alternative safeguards where necessary. 
• Ensure research activities comply with the broader definition of scientific research and update consent mechanisms where purposes are not fully defined at the time of collection. 
• Align DSAR workflows with the revised requirements, including searches for DSARs and exemption notifications. Prepare clear internal processes to manage and respond to individual complaints within 30 days. 
• Revisit cookie banners and consent mechanisms to ensure compliance with updated PECR rules. 
• Work with your marketing teams to adjust practices for direct marketing, particularly to make use of the expanded soft opt-in for charities and potentially other sectors once clarified. 
• Establish internal tracking systems or assign responsibility for monitoring developments as secondary legislation is introduced. 

Conclusion 

The Data (Use & Access) Act 2025 introduces important changes to the UK’s data protection landscape, with implications for a wide range of organisations. While key changes to UK GDPR and PECR are expected to come into effect soon, much of the Act will be phased in gradually through future regulations. This means that many provisions will only take effect once specific implementation dates are set by the government. Organisations should stay informed about these developments and be ready to adapt their practices as different parts of the legislation come into force.  

Our Data Protection team has extensive experience guiding UK organisations through complex regulatory changes, including new data protection legislation. To learn more about how our data specialists can support your compliance efforts, explore the range of services we offer or get in touch to discuss how we can help.