Data Use and Access Act 2025: What Changes for IT

What the Act changes for UK organisations — at a glance

DUAA is an amending statute, not a replacement. It inserts new provisions into the existing UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR), rather than rewriting the framework from scratch. GOV.UK is explicit on this point: the Act does not replace any of the three instruments it touches.

A new Article 6 lawful ground covers processing by non-public bodies for specified recognised legitimate interests — crime prevention, safeguarding vulnerable people, emergency response, national-security protection, and assisting certain legally authorised public-interest tasks, subject to necessity. The Act creates limited PECR exemptions for specified low-risk storage or access technologies, including some cookies, where the statutory conditions are met; it does not remove consent requirements for advertising, profiling or other non-exempt tracking. A more permissive framework now applies to solely automated decisions with legal or similarly significant effects on individuals, subject to statutory conditions and safeguards. Subject access request deadlines gain a "stop the clock" mechanism where the controller requests information genuinely needed to locate or process the request, resuming once that information is supplied. And two narrower clarifications apply to scientific research consent and to the design of online services likely to be accessed by children.

None of this is a deregulation event. Every one of these changes sits inside a framework where necessity, data minimisation, security and accountability obligations remain fully in force.

Mid-2026 commencement tracker: in force, dated and still open

The single biggest operational risk is assuming the whole Act switched on at Royal Assent. It didn't — commencement happened in distinct stages, each set by its own regulations, and IT teams need to know which stage applies to which provision before relying on it.

Royal Assent landed on 19 June 2025. The first commencement regulations brought specified Part 1 Smart Data scheme provisions and specified data-protection amendments into force on 20 August 2025. Legal-professional-privilege and national-security exemption provisions commenced shortly afterwards, under their own commencement regulations. Joint-processing provisions covering intelligence services and competent authorities followed on 17 November 2025. The Act's main digital-verification measures — mostly commenced under the Commencement No. 4 Regulations 2025 — came into force on 1 December 2025; this digital-verification trust framework sets standards for certified identity-checking services, including digital verification services organisations can rely on for right-to-work, right-to-rent and similar checks, which matters for IAM teams integrating or accrediting third-party identity providers. The majority of the Act's data-protection and privacy provisions, including the recognised-legitimate-interests ground, the cookie exemption, the automated-decision-making changes and the SAR stop-the-clock rule, commenced on 5 February 2026 under the Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026. The data-subject complaints-procedure duty commenced on 19 June 2026. By that date, all data-protection provisions of the Act were in force, though some non-data-protection provisions, including certain ICO governance measures, may follow separate commencement dates — verify each provision before relying on it.

That is five separate commencement dates across roughly twelve months, each governing a different slice of the Act. Check the specific provision in the latest commencement regulations before relying on any clause in a policy, DPIA or contract.

UK GDPR, DPA 2018 and PECR: the old rule versus the DUAA rule

Strip away the legal drafting and the changes land on four areas of day-to-day processing, plus two narrower clarifications that affect research teams and consumer-facing product design. The table below sets out what moved, when it commenced and what IT needs to do about it.

• •Recognised legitimate interests covers five statutory categories only — it is not a general route around the ordinary legitimate-interests test for commercial processing.
• •The cookie/storage exemption is limited to specified low-risk purposes; it creates no blanket permission for advertising or profiling technologies.
• •Scientific research consent can now cover related research areas under a broader consent model, and services likely to be accessed by children must factor in design protections for them — both changes apply alongside the existing accountability and transparency duties, not instead of them.

The changes with the biggest operational impact

Recognised legitimate interests is the headline change, and the decision test is narrower than it sounds. The processing must fall within one of the five Annex 1 categories (inserted via Schedule 4 of the Act) — crime prevention, safeguarding vulnerable people, emergency response, national-security protection, or assisting legally sanctioned public-interest tasks. Within that list, the requirement that processing be necessary remains in full; what disappears is the detailed balancing assessment between the controller's interests and the individual's interests. Outside that list, nothing has changed: ordinary legitimate-interests processing still requires the complete necessity-and-balancing exercise, and GOV.UK's own factsheet is explicit that the new ground is not a general exemption for ordinary commercial processing.

Automated decision-making moves to a more permissive framework for solely automated decisions with legal or similarly significant effects, but only where the statutory conditions and safeguards are met — credit, recruitment and eligibility systems must be assessed individually rather than assumed to qualify. Affected decisions remain subject to statutory safeguards and governance requirements. The practical reading for IT teams building or buying decisioning systems is that a wider doorway has opened, but the specific statutory safeguards attached to each decision still have to be identified and kept in place — not assumed to be an identical human-review route across every system.

Subject access requests get a genuinely useful operational clarification. The Act allows the response period to be paused where the controller requests information genuinely needed to locate or process the request; the period resumes when the requester supplies it, subject to the statutory conditions and applicable transitional rules — removing a long-standing grey area where organisations risked missing statutory deadlines while waiting on requester clarification they'd already asked for.

Worked example: a UK SaaS provider updates its data and AI governance

Take a UK SaaS company running a fraud-detection feature for its e-commerce customers, alongside a credit-risk scoring module and a standard analytics stack. Before DUAA, sharing suspected-fraud signals with a sector fraud-prevention body required a full legitimate-interests assessment — identify the interest, demonstrate necessity, and balance it against the data subject's rights — recorded afresh for each sharing arrangement. After the 5 February 2026 commencement, if that specific sharing genuinely falls within the crime-prevention category, the company can rely on the recognised-legitimate-interests ground: necessity still has to be documented, but the balancing step is removed. The record of processing activities should flag which entries rely on this route versus the ordinary test.

On the analytics side, the product team reviews its cookie inventory rather than switching consent off wholesale. Some storage and access technologies may qualify for the exemption where they meet the Act's specified low-risk purposes and conditions, so each technology is assessed individually; advertising, profiling and cross-site tracking remain outside the exemption and still need the same consent treatment as before. On the credit-scoring module, the governance team identifies the specific statutory safeguards and governance requirements that apply to that decision and documents them — the more permissive legal basis does not remove the obligation to keep those safeguards operating, and the team does not assume every system has an identical human-review route.

None of this is a one-off project. It is a governance update: re-tag existing records against the new ground where it genuinely applies, re-segment the cookie inventory, and confirm SAR tooling supports the stop-the-clock pause — then move on.

What IT, security and privacy teams need to change now

It is worth stating plainly what remains largely intact, because it covers the majority of the framework. Ordinary legitimate-interests processing outside the five recognised categories still requires the full necessity-and-balancing assessment. Core duties around transparency, data minimisation, security and accountability are not removed by any of the changes that commenced on 5 February 2026 or earlier, though the Act does modify a number of related rules — including further-processing conditions, international-transfer tests, privacy-notice requirements and complaint-handling duties — so the specific amended provision should be checked rather than assuming it is untouched. On international transfers specifically, DUAA introduces a revised "data protection test" for assessing third countries and alternative transfer mechanisms, intended to be more outcomes-focused than the previous adequacy-style approach — but it does not remove the underlying requirement to have a lawful transfer mechanism in place. For organisations buying cloud, hosting or managed-infrastructure services, this means existing contractual clauses covering international transfers, data residency and sub-processor locations with hyperscalers and other vendors should be reviewed against the updated test rather than assumed to be automatically compliant — particularly where data is processed or backed up outside the UK. The cookie exemption does not extend to advertising or profiling technologies. The automated-decision changes do not remove the governance and safeguard requirements attached to significant decisions.

• •Update the record of processing activities to flag which entries rely on recognised legitimate interests versus the ordinary legitimate-interests test, with the specific statutory category named for each.
• •Audit the cookie and consent-management platform configuration to separate genuinely low-risk statistical/functionality technologies from everything that still requires explicit consent under PECR.
• •Confirm SAR intake tooling and workflows support the stop-the-clock pause — logging when the clock stopped, what was requested, and when it resumed.
• •Review automated-decision pipelines (credit, recruitment, eligibility) to identify the specific statutory safeguards and governance requirements that apply to each decision — rather than assuming a single uniform human-review route — as part of ongoing cyber security compliance work.
• •Ask suppliers whose telemetry, monitoring or fraud-control tools touch UK personal data to state the exact processing condition they rely on in their own records — don't assume DUAA gives their product automatic cover.
• •Fold DUAA tagging into existing UK GDPR and DPIAs processes and access reviews under identity and access management, rather than running a separate parallel process.

What the Act does not loosen

It is worth stating plainly what remains largely intact, because it covers the majority of the framework. Ordinary legitimate-interests processing outside the five recognised categories still requires the full necessity-and-balancing assessment. Core duties around transparency, data minimisation, security and accountability are not removed by any of the changes that commenced on 5 February 2026 or earlier, though the Act does modify a number of related rules — including further-processing conditions, international-transfer tests, privacy-notice requirements and complaint-handling duties — so the specific amended provision should be checked rather than assuming it is untouched. The cookie exemption does not extend to advertising or profiling technologies. The automated-decision changes do not remove the governance and safeguard requirements attached to significant decisions.

Where the recognised-legitimate-interests ground does apply, it saves one step of a multi-step test for a defined set of purposes — it is not a general licence for any processing a business considers to be in its interest. Teams should treat every DUAA-related change as a record-keeping and configuration exercise sitting inside the existing compliance structure, not a replacement for it.

Verdict: who benefits, who faces the most work

Organisations whose processing genuinely falls within the five recognised categories — fraud and crime-prevention operations, safeguarding platforms, incident-response and emergency-management systems, and critical-infrastructure operators with national-security relevance — get the clearest, most immediate benefit: less assessment overhead for a defined set of existing activities. Consumer-facing SaaS and e-commerce businesses get a modest win on genuinely low-risk analytics cookies, but the work is an audit, not a switch-off, and most tracking and advertising technology sees no change at all.

Businesses running significant automated decisions — lending, recruitment, eligibility assessment — face the most governance work: a wider legal doorway has opened, but the statutory safeguards and governance requirements behind it remain and depend on the specific decision and data involved, and legal review of exactly how each system qualifies — including which safeguards apply — is the sensible next step before relying on the new framework. Every organisation handling UK personal data should update SAR tooling for the stop-the-clock rule regardless of sector — it is the one change that benefits almost everyone with minimal risk. Where a recognised-interest category or an automated-decision pathway is genuinely in play, specialist legal advice remains the right call before any policy or contract is rewritten around it.

Sources

Every figure in this article traces to the sources below.

• •GOV.UK — Data Use and Access Act 2025: data protection and privacy changes
• •GOV.UK — Data Use and Access Act 2025: plans for commencement
• •GOV.UK — DUAA factsheet: UK GDPR and DPA
• •legislation.gov.uk — Commencement Regulations (SI 2025/904)
• •legislation.gov.uk — Commencement Regulations (SI 2025/996)