Course Features
Short day session 10am - 3pm
Experienced instructor
Record of attendance
Public schedule
In-company options
Course Overview
After years of delays, the Data (Use and Access) Bill (DUA Bill) successfully cleared its final hurdle in the House of Lords and received Royal Assent on Thursday, 19 June 2025. It is now known as the Data (Use & Access) Act 2025.
The DUA Act introduces several amendments to the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations (PECR).
Key changes in the Act cover limitations to Subject Access Requests (SARs), the introduction of recognised legitimate interests, and modifications to rules relating to automated decision-making (ADM). Other UK GDPR amendments include revisions to international data transfers, purpose limitation, scientific research and enhanced protections concerning children's data. The Act also relaxes rules governing the use of cookies and aligns fines for non-compliance with PECR with those of the UK GDPR. In terms of criminal law enforcement processing under Part 3 of the DPA18, the Act clarifies the definition of consent, aligns response times for data subject rights with those of the UK GDPR and introduces additional requirements to codes of conduct for competent authorities. Meanwhile, the Information Commissioner's Office (ICO) will undergo significant organisational changes and will now be known as the Information Commission.
The UK government believes its legislative amendments will encourage innovation and enhance public trust without jeopardising the UK's vital data adequacy status with the European Union. This assumption has yet to be confirmed. While many of the provisions contained within the DUA Act are technical in nature, they are nonetheless significant in several important areas and require careful consideration.
This one-day course is designed for experienced UK-based practitioners with a solid understanding of the UK GDPR, DPA18 and PECR, and who are required to maintain their expert knowledge of data protection law.
