What is it?
The Data (Use and Access) Act 2025 (DUAA) is a law passed by parliament in June 2025. It changes (but does not replace) the:
- UK General Data Protection Regulation (UK GDPR)
- Data Protection Act 2018
- Privacy and Electronic Communications Regulations (PECR)
What does it change?
The main aim of the DUAA is to promote innovation and economic growth by streamlining data protection processes.
The act doesn't introduce many new requirements – it clarifies existing laws and makes it easier to process data for specific reasons (while still keeping it safe).
Changes include:
- It's easier for organisations to use (or reuse) personal data for legitimate purposes, such as scientific research, healthcare and law enforcement
- It allows the wider use of AI for automated decision-making
Helping people complain to an organisation about how their data is used (this does affect your school – see more on this