DUAA 2025: What the UK’s Most Significant Data Protection Reform Since GDPR Means for Your Organisation

Executive Summary

The Data Use and Access Act 2025 (DUAA) is the most significant reform to UK data protection law since the introduction of the GDPR. It is not a wholesale replacement. It is a purposeful and far-reaching modernisation of the UK GDPR and the Data Protection Act 2018 — one that every UK organisation with a data protection programme must now actively address.

The Act introduces greater operational flexibility in several important areas: automated decision-making, legitimate interests, subject access requests, cookie classification, and the use of data for research. At the same time, it introduces a mandatory complaint handling obligation and reinforces expectations around accountability, transparency, and governance.

The central message for 2026 is this: DUAA increases flexibility, but it does not reduce responsibility. Organisations that treat the Act as an opportunity to relax their programmes are misreading it. Those that use it to recalibrate governance intelligently will be well positioned — operationally and reputationally.
With the main data protection reforms active since February 2026 and the statutory complaints requirement coming into force on 19 June 2026, this year is a critical transition period. Now is the time to act.

What Has Actually Changed?

The DUAA modifies — rather than dismantles — the existing UK data protection framework. The following areas have been materially updated:

• Automated Decision-Making and AI: Significant automated decisions may now rely on a broader range of lawful bases, including legitimate interests.
• Legitimate Interests: A defined list of ‘recognised’ interests no longer requires a balancing test. All others still do.
• Subject Access Requests: Organisations must conduct ‘reasonable and proportionate’ searches, moving away from exhaustive disclosure expectations.
• Cookie Classification: Certain low-risk cookies may be exempt from consent requirements under PECR.
• Research Use of Data: Commercial research is now formally recognised within the scientific research framework, with associated flexibility.
• Children’s Data: Heightened standards apply to online services likely accessed by children.
• Mandatory Complaints Handling: From 19 June 2026, organisations must have a formal, documented data protection complaints process.
Taken together, the Act modernises the regime. Each area of flexibility comes paired with accountability expectations that organisations must understand and operationalise.

Deep Dive: Operational Impact by Area

A. Automated Decision-Making and AI

Previously: Under UK GDPR Article 22, significant automated decisions could only be made on the basis of explicit consent, contractual necessity, or legal obligation. This created substantial friction for organisations deploying AI, fraud detection engines, eligibility models, and profiling tools.

What DUAA changes: The Act broadens the permissible lawful bases for significant automated decisions. Legitimate interests can now underpin such processing, provided appropriate safeguards are in place.

Where flexibility increases: Organisations have greater latitude to deploy AI-driven decision-making tools using legitimate interests, reducing reliance on consent in contexts where it was commercially impractical.
Where safeguards remain: The Act does not remove the requirement for transparency, human review mechanisms, or the ability for individuals to challenge decisions. DPIAs remain mandatory where processing is likely to result in high risk. Bias documentation and fairness testing are now more important, not less.

What organisations should do now

• Review all AI, profiling, and automated decision-making systems against the updated lawful basis framework.
• Update DPIAs to reflect which systems produce significant automated decisions and document the chosen lawful basis.
• Where switching to legitimate interests, conduct or refresh a Legitimate Interests Assessment (LIA).
• Update privacy notices to reflect the revised lawful basis and safeguard information.
• Implement and document human oversight thresholds — at what point does a human review override an automated output?
• Document model explainability: can you explain, in plain terms, how a significant decision was reached?
• Establish periodic bias review processes and document fairness testing methodology.
• Maintain an AI governance log as an audit-ready record of oversight and control.

The critical point: DUAA allows flexibility in AI — but only with demonstrable safeguards. If your governance documentation does not keep pace with this flexibility, you are creating risk, not managing it.

B. Legitimate Interests Reform

Previously: Every reliance on legitimate interests required a three-part balancing test: purpose, necessity, and balancing against individual rights.

What DUAA changes: The Act introduces a list of ‘recognised legitimate interests’ — including safeguarding, crime prevention, and certain public safety purposes — for which the balancing test is no longer required.

Where flexibility increases: Organisations relying on recognised interests can proceed without a full LIA for those specific activities, reducing administrative burden in time-sensitive contexts.

Where safeguards remain: For all other legitimate interests — the vast majority of commercial use cases — the three-part balancing test is still required. The LIA does not disappear.

What organisations should do now

• Map all current legitimate interests reliance across your processing activities.
• Identify which activities, if any, fall within the recognised interests list.
• For recognised interests, document why the exemption applies and retain that documentation.
• For all other legitimate interests, continue conducting and documenting LIAs to the existing standard.
• Update your ROPA to reflect any lawful basis changes, combining purposes and legitimate interests documentation.

The risk to avoid: Treating the recognised interests list as a blanket relaxation of the framework. It is a narrow, defined carve-out. Most commercial processing will not qualify.

C. Subject Access Requests — “Reasonable and Proportionate”

Previously: The default expectation was that organisations would conduct thorough searches of all systems holding personal data when responding to SARs.

What DUAA changes: Organisations must now conduct ‘reasonable and proportionate’ searches. This does not mean minimal searches. It means searches calibrated to the nature, scope, and context of the request — and that can be defended as such.

Where flexibility increases: Disproportionate system searches where burden significantly outweighs likely value may, in appropriate circumstances, be scoped out.

Where safeguards remain: Any narrowing of search scope must be documented, justified, and proportionate. Vague statements such as ‘no data found’ are no longer sufficient.

What organisations should do now

• Define and document your standard SAR search scope — which systems are included as a matter of course.
• Establish clear criteria for when archived or legacy systems must be searched.
• Create an audit trail for all SAR searches: tools, filters, date and time, and any scope limitations.
• Update SAR response language to provide clear, defensible explanations where search scope has been narrowed.
• Train relevant staff on the defensibility expectation — proportionate does not mean convenient.

D. Cookies and Consent

Previously: PECR required consent for all cookies that were not strictly necessary for a service the user had requested.

What DUAA changes: Certain low-risk cookies — such as some analytics cookies that do not track individuals across third-party sites — may now be deployed without prior consent, provided they meet defined criteria. Marketing and tracking cookies remain subject to strict consent requirements.

Where safeguards remain: Transparency obligations continue to apply. Misclassification — treating a tracking or marketing cookie as low-risk to avoid consent — will be an enforcement trigger.

What organisations should do now

• Conduct a full cookie audit across all domains and services.
• Assess whether each cookie genuinely meets the criteria for low-risk classification under the updated PECR framework.
• Document the rationale for any exemption from consent, including vendor evidence where relevant.
• Update CMP configuration only for cookies that have been formally classified and documented.
• Treat your cookie governance documentation as audit evidence, not a one-time exercise.

E. Research Use of Data

What DUAA changes: The Act formally extends the scientific research framework to include commercial research, allowing broader consent, reduced privacy notice obligations in certain circumstances, and greater compatibility of purpose for secondary data use — all subject to defined safeguards.

Where safeguards remain: Research purposes must be clearly defined. Pseudonymisation is expected where feasible. Broad consent wording must be intelligible and specific enough to be meaningful.

What organisations should do now

• Define and document the scope of your research activities, distinguishing them clearly from marketing or commercial exploitation.
• Review consent language for research activities to ensure it is clear, intelligible, and appropriately broad without being open-ended.
• Implement and document pseudonymisation and access controls for research datasets.
• Conduct compatibility assessments for secondary research use where required.

F. Children’s Data

What DUAA reinforces: Online services likely to be accessed by children must explicitly consider, document, and address children’s data protection needs. Where there is a reasonable likelihood of child access, the standard applies.

What organisations should do now

• Identify all services and platforms with a reasonable likelihood of child access.
• Conduct children-specific DPIAs for those services.
• Apply high-privacy default settings as the baseline.
• Review and restrict profiling and behavioural targeting for services accessible to children.
• Assess age verification or age assurance mechanisms where appropriate.

G. Mandatory Complaints Handling (Live 19 June 2026)

What DUAA introduces: From 19 June 2026, organisations must have a formal, documented data protection complaints handling process. Individuals will have a statutory right to raise complaints directly with organisations. Acknowledgement within 30 days is required; a full response must follow without undue delay.
This is an operational governance requirement. It is not satisfied by a policy document alone. It requires a functioning workflow, trained staff, assigned accountability, and an audit trail.

Implementation roadmap

1. Draft and adopt a formal data protection complaints procedure, including definitions, escalation routes, and accountability assignments.
2. Create template communications: acknowledgement letters, investigation updates, and outcome notices.
3. Implement a complaints tracking system with SLA monitoring against the 30-day acknowledgement requirement.
4. Train customer-facing and data protection teams on complaint identification and escalation.
5. Establish clear interaction between the complaints process and existing SAR workflows.
6. Assign board-level or DPO accountability for the complaints function.
7. Test the process before June with a tabletop exercise.
The deadline is fixed: 19 June 2026. Organisations that do not have a compliant process in place on that date will be in breach from day one.