The Data Use and Access Act 2025 (DUAA) - summary of the changes to data protection law

This summarises the changes the DUAA makes to data protection law that may affect you if you’re an organisation using personal information.  

It isn’t a replacement for our existing guidance for organisations that we will update over time, and as the changes come into effect. It should, however, help you understand what the changes are in the meantime. You can find more details about the updates we’re working on in Our plans for new and updated guidance.  

This is a factual summary of the changes that each relevant section of the DUAA makes, but it does not cover how you interpret or apply the law. We’ll address this as we develop and update our guidance for organisations, in consultation with relevant stakeholders.   

It’s aimed at data protection experts, including Data Protection Officers (DPOs) and people with specific data protection responsibilities. It’s for people who already understand the current law. It explains what has changed rather than providing a comprehensive guide or explanation about data protection law. 

If you’d prefer a brief overview of how the DUAA might affect your organisation, please see The Data Use and Access Act 2025 (DUAA) - What does it mean for organisations?. 

If you’d prefer a brief overview of how the DUAA affects law enforcement agencies, please see The Data Use and Access Act 2025 (DUAA) - What does it mean for law enforcement agencies?. 

If you’d prefer a brief overview of how the DUAA might affect how your own personal information is used by organisations, please see The Data Use and Access Act 2025 (DUAA) - How does this affect me?. 

This guidance follows the order and headings in the DUAA for ease of reference. It summarises all the significant changes.  

If a section makes minor, consequential, or technical changes that don’t significantly change the law, we’ve noted this without explaining the detail.    

If a section makes changes that don’t directly affect you, we’ve noted this without explaining the detail (eg changes to the ICO’s responsibilities or the powers of the Secretary of State). 

If the DUAA changes the law that applies to competent authorities which use personal information for law enforcement purposes (part 3 of the Data Protection Act 2018 (DPA)), or to the use of personal information by the intelligence services (part 4 of the DPA), we’ve noted this. Otherwise, the changes relate to the general use of personal information by other organisations.