DUAA 2025 amends UK GDPR rather than replacing it. Three changes worth understanding: recognised legitimate interests, the materially-lower transfers test,…
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. It is the first substantial reform to UK data protection law since the post-Brexit handover in 2021, and it sits alongside the UK GDPR rather than replacing it. For most small businesses with a privacy policy already in place, the immediate question is: what do I actually have to change?
The honest answer is: not much, yet. But there are three things worth understanding now, because they will affect what your privacy policy says, what your data sharing arrangements look like, and what you have to do when a customer complains.
Loading interactive view…