Data (Use and Access) Act 2025 passed into law

Less than seven days after clearing its final hurdle in the House of Lords, an update to the Parliamentary Bills webpage confirmed on Tuesday that the Data (Use and Access) Bill (DUA Bill) is set to receive Royal Assent on Thursday, 19 June 2025.

On visiting the Parliamentary Bills site on Thursday, the page now confirms that: "Following agreement by both Houses on the text of the bill it received Royal Assent on 19 June. The bill is now an Act of Parliament (law)."

The press release by the Department for Science, Innovation and Technology (DSIT) claims the benefits of the Data (Use and Access) Act 2025 (DUA Act) will add up to £10 billion to the UK economy over the next 10 years, through efficiencies to the NHS and police, while helping to drive innovation in technology and science. 

To coincide with the Bills passing into law, the Information Commissioner's Office (ICO) has published several supporting documents for organisations and practitioners, including frequently asked questions documents for organisations and law enforcement agencies, a detailed summary of the changes for data protection experts, information outlining the timescales when the ICO intends to update guidance materials, and what to expect from the ICO concerning enforcement activities. 

For practitioners, the hard work starts now. Part of this will involve understanding how the relevant provisions contained within the DUA Act will amend the UK's existing data protection legislation: the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations (PECR). A blog article by Jon Baines on his personal blog discusses this point, highlighting that "when a piece of legislation is amended, Parliament doesn't reenact it, so the 'official' printed version remains." 

Baines goes on to describe how this has changed from the pre-Internet days, requiring practitioners to read the original and updated text side by side, often with the assistance of legal publishers that would print consolidated versions showing amendments in mark-up. In today's more modern times, while online versions make it easier to access consolidated versions, Baines remarks the process hasn't changed all that much. 

The ICO has also published a guide explaining what the changes will mean for individuals.

Training announcement: Discover the key amendments in the Data (Use and Access) Act 2025. Join us for a comprehensive one-day workshop and learn about the implications to UK data protection law. Aimed at practitioners, public schedule and onsite course options are available. Find out more.