People

Careers

Corporate

Commercial

Employment

News & Insights

Blog

News

Videos

Who we are

Environment & Sustainability

Diversity, Equity & Inclusion

WONDER Foundation

Get legal updates and practical guidance straight to your inbox.

You’ve successfully signed up to the Linnear Legal mailing list

Home

Resources

<p>Registered in England &amp; Wales at 73 Shelton Street, Covent Garden, London, WC2H 9JQ</p>
<p><a href="tel:+442081596000">Tel: +44 (0)20 8159 6000</a></p>
<p>Company Nr: 15894546</p>
<p>ICO Registration Nr:  ZB842887</p>
<p style="text-align: left;">VAT Registration Nr: 484 5226 73</p>
<p>Linnear Legal is an unregulated legal services provider, meaning the firm itself is not regulated by the Solicitors Regulation Authority (SRA). However, the solicitors employed by the firm are individually regulated by the SRA. Please see our Terms and Conditions for further information on our regulatory status, complaints procedure and insurance arrangements.</p>


Terms & Conditions

Cookie Policy

Privacy Policy

Services

Insights

About

We are driven by doing things differently, from every angle. 

Taking our Carbon Neutral Certified  status seriously.  

Putting equity and inclusion at the heart of everything we do.

Supporting sustainable employment and gender equality with WONDER. 

WONDER foundation

Contact us

The Data (Use and Access) Act 2025 introduces sweeping reforms to the UK’s data laws, aimied at simplifing digital administration, empowering consumers and boosting innovation. With implications for healthcare, digital ID, marketing and AI governance, the Act signals a decisive step towards modernising the UK’s data economy.

New UK data law promises streamlined services, smarter regulation and £10 billion in economic gains over the next decade.

<p>On 19 June 2025, after a prolonged ‘ping-pong’ process between the House of Commons and the House of Lords, the Data (Use and Access) Bill received Royal Assent, becoming the <a href="https://bills.parliament.uk/bills/3825" target="_blank" rel="noopener">Data (Use and Access) Act 2025</a> (the DUA Act) and ushering in a new era of UK data regulation. Promised as a pillar of the government’s Plan for Change, the Act is a comprehensive and ambitious reform package designed to unlock the economic and social potential of data, while streamlining bureaucracy and reinforcing individual rights.</p>
<p>The Act’s journey to Royal Assent was fraught with delay and political turbulence. Initially introduced as the Data Protection and Digital Information Bill in March 2023 under the Conservative government, the bill failed to pass before the 2024 General Election. The newly elected Labour government reintroduced it as the Digital Information and Smart Data Bill, before renaming it the Data (Use and Access) Bill.</p>
<p>The Act’s turbulent journey through parliament was mainly due to disagreements around AI provisions. Nonetheless, the bill has now passed in its final form and is set to be implemented in phases over the next parliamentary term.</p>
<h2>Modernising the UK’s data regime</h2>
<p>As economists and political commentators often point out, many of the UK’s biggest political challenges, such as housing or healthcare, are multifaceted, complex problems that require systemic solutions. Modernising the UK’s data regime has been cited as one such change that will help address these problems, by streamlining data processing, enabling cross-platform data sharing and legislating on digital verification services – all changes that are envisioned to help reduce unnecessary bureaucracy and ‘turbo-charge’ innovation.</p>
<p>In a <a href="https://www.gov.uk/government/news/new-data-laws-will-make-life-easier-for-british-people-cutting-life-admin-easing-traffic-and-speeding-up-roadworks">government press release</a>, Technology Secretary Peter Kyle said: ‘For too long, previous governments have been sitting on a goldmine of data, wasting a powerful resource which can be used to help families juggle food costs, slash tedious life admin, and make our NHS and police work smarter. These new laws will finally unleash that power.’</p>
<p>The government claims it will inject £10 billion into the UK economy over the next decade through productivity gains and efficiency savings – particularly in the NHS, policing and infrastructure sectors.</p>
<h2>Key reforms at a glance</h2>
<h3>Transforming public services</h3>
<h4>NHS interoperability</h4>
<p>Health data will be shareable in real time across NHS trusts, GP surgeries, and ambulance services – regardless of t IT system. This is expected to save 140,000 hours of staff time annually, allowing for quicker diagnoses and more time with patients.</p>
<h4>National Underground Asset Register (NUAR)</h4>
<p>A new digital map of the UK’s underground infrastructure will allow construction workers to locate pipes and cables in seconds instead of days, speeding up roadworks and minimising disruption for drivers.</p>
<h4>Police and bereavement investigations</h4>
<p>The Act introduces new powers requiring Ofcom to issue data preservation notices to social media platforms when requested by coroners investigating child deaths linked to online activity.</p>
<h3>Empowering consumers</h3>
<h4>Smart data and price comparisons</h4>
<p>The Act facilitates third-party access to consumer data – with consent – enabling the development of smarter apps and services. It’s envisioned that this will help households reduce costs by enabling hyper-personalised energy and shopping comparisons.</p>
<h4>Digital identity verification</h4>
<p>The Act establishes a trust framework and certification scheme for Digital Verification Services (DVS), allowing individuals to prove their identity online more easily – for renting, job applications, and more.</p>
<h3>Reducing administrative burdens</h3>
<h4>Data Subject Access Requests (DSARs)</h4>
<p>The new regime permits organisations to respond to DSARs with searches that are ‘reasonable and proportionate’, reducing the burden on businesses.</p>
<h4>Automated decision-making (ADM)</h4>
<p>The Act softens restrictions on ADM, particularly where sensitive data is not involved. It encourages responsible AI use by requiring ‘meaningful human intervention’ in significant decisions and granting individuals the right to contest outcomes.</p>
<h4>Purpose limitation</h4>
<p>The concept of ‘further processing’ is clarified, with clear criteria to assess whether new uses of data remain within original boundaries – a practical tool for compliance teams.</p>
<h3>Regulatory modernisation</h3>
<h4>ICO reform</h4>
<p>The Information Commissioner’s Office (ICO) will be restructured and renamed the ‘Information Commission’, with board oversight and a new duty to encourage resolution of complaints at organisational level before escalation.</p>
<h4>Stronger fines under PECR</h4>
<p>Fines for breaches of direct marketing rules will now match GDPR levels – up to £17.5 million or 4% of global turnover, whichever is higher.</p>
<h4>Cookie reform</h4>
<p>The Act eases cookie consent requirements by defining specific uses as ‘strictly necessary’ (e.g. fraud detection, site performance). This should streamline UX and reduce banner fatigue.</p>
<h3>Promoting innovation and research</h3>
<h4>Scientific research exemptions</h4>
<p>The Act expands the definition of scientific research to include commercially funded studies and relaxes conditions around consent for processing special category data.</p>
<h4>Access to online safety data</h4>
<p>Academic researchers will benefit from a new legal pathway to request data from online platforms, in the interest of studying online harms and safety.</p>
<h4>Children’s data</h4>
<p>Enhanced protections for children are mandated, including a requirement that the ICO consider children’s vulnerability in data-related decisions.</p>
<h2>The AI and copyright debate</h2>
<p>One of the most contentious aspects of the DUA Bill’s passage through Parliament was the debate over the use of data for training AI models – particularly where copyright-protected works were concerned. Artists, publishers and civil liberties groups voiced strong concerns about unregulated AI scraping. In the end, the government chose to pass the Act<a href="https://www.linnearlegal.co.uk/resources/ai-copyright-clauses-dropped-data-use-access-bill/"> without a final provision on this issue</a>, pledging instead to conduct a separate public consultation. That consultation is expected to open later this year and will be critical in shaping the UK’s AI regulation regime.</p>
<h2>The UK’s Data Adequacy Status in the EU</h2>
<p>Beyond domestic reform, the Act’s timing may prove crucial in maintaining the UK’s data adequacy status with the EU. The current adequacy decision – which allows data to flow freely from the EU to the UK – is due to expire in December 2025. The European Commission had been waiting for the UK to finalise its post-Brexit data regime before assessing whether the UK&#8217;s legal framework still meets adequacy requirements. With the DUA Act now passed, that assessment can begin. UK businesses will hope the new regime is liberal enough to encourage innovation, but robust enough to pass muster in Brussels.</p>
<h2>What should businesses do now?</h2>
<p>The DUA Act does not demand wholesale reinvention of privacy programmes, but businesses should still take proactive steps to prepare:</p>
<ul>
<li>Review processing activities to determine which changes (e.g. cookie consent, DSARs, ADM) apply</li>
<li>Update internal documentation, such as privacy notices and DPIAs, to reflect new terminology and requirements</li>
<li>Assess marketing risks, particularly under PECR if engaging in B2C campaigns</li>
<li>Explore new opportunities enabled by the Act – for example, smart data schemes, digital ID verification or scientific research exemptions</li>
<li>Stay engaged with the AI copyright consultation, especially if your organisation uses AI tools that rely on data scraping</li>
</ul>
<p>For tailored advice on how the Act affects your business or organisation, <a href="https://linnearcms.wpenginepowered.com/get-in-touch/">speak to a solicitor</a> at Linnear Legal.</p>


The DUA Act modernises UK data law to cut red tape, expand digital rights and support innovation, while reinforcing compliance obligations and preserving EU data adequacy post-Brexit.

The Data (Use and Access) Bill 2025 receives Royal Assent 

The Data (Use and Access) Act 2025 modernises UK data law to boost innovation and reduce bureaucracy. Key changes affect health, policing and digital ID.

The Data (Use and Access) Bill 2025 receives Royal Assent  | Linnear Legal

https://linnearcms.wpenginepowered.com/wp-content/uploads/2025/06/shutterstock_2502153963.jpg

Linnear Legal

https://linnearcms.wpenginepowered.com/wp-content/uploads/2025/01/Linnear-Legal-logo.png

https://secure.gravatar.com/avatar/430378ba79491bc6fd9321b5f889b7c8c3b4952c79a934ef05647cb5b4385d93?s=96&d=mm&r=g

The Data (Use and Access) Bill 2025 receives Royal Assent

Related Insights