Journey

Prepare for the Data Use and Access Act 2025 changes

A step-by-step guide to understanding and adapting to the Data (Use and Access) Act 2025. Covers the 8 key reforms now in force, including recognised legitimate interests, SRI replacing DPO, cookie consent changes, and the 35x increase in PECR penalties.

Running a Business Updated 15 September 2026

6 milestones references 3 guides

What is the Data Use and Access Act 2025?

The Data (Use and Access) Act 2025 (DUAA) is the biggest reform to UK data protection law since the UK GDPR. It received Royal Assent on 19 June 2025, and the majority of its data protection provisions came into force on 5 February 2026.

The DUAA does not replace the UK GDPR or DPA 2018. It amends them, introducing 8 key changes that affect how businesses handle personal data, cookies, and electronic marketing.

Understand the 8 key changes

Start by understanding what has changed. The DUAA introduces reforms across lawful bases, governance, cookies, penalties, and automated decisions.

Data Use and Access Act 2025: what changed for businesses

A comprehensive explainer covering all 8 DUAA reforms, commencement timeline, and what each change means in practice.
Review your lawful bases
The DUAA introduces a new seventh lawful basis: recognised legitimate interests. This applies to specific purposes (national security, public safety, crime prevention, emergencies, safeguarding) without requiring a balancing test.

Review whether any of your processing activities could use this new basis. For most commercial activities (marketing, customer analytics, business operations), the existing six lawful bases still apply unchanged.
New: Recognised legitimate interests

This new lawful basis is narrower than many businesses expected. It applies only to pre-approved purposes, not to general commercial processing.
The DUAA 2025 introduces a new lawful basis under Article 6(1)(ea) UK GDPR called recognised legitimate interests. This allows processing for certain pre-approved purposes listed in a new Annex 1 to the UK GDPR without requiring a Legitimate Interest Assessment (balancing test).

New lawful basis

Article 6(1)(ea) UK GDPR - recognised legitimate interests

In force from

5 February 2026

Balancing test required

No - unlike Article 6(1)(f) legitimate interests, no LIA balancing test is needed

Who can use it

Any controller, including public authorities (unlike standard legitimate interests)

Recognised purposes (Annex 1 to UK GDPR)

National security

Public security

Defence

Emergencies (responding to emergencies affecting life, health, or safety)

Crime prevention and detection (including safeguarding vulnerable individuals)

Important: The Secretary of State can add or remove purposes by regulation. Direct marketing and intra-group data sharing still require a standard Legitimate Interest Assessment under Article 6(1)(f).

Distinct from standard legitimate interests

Article 6(1)(f) (standard legitimate interests with balancing test) continues to exist alongside the new Article 6(1)(ea)

Data subject rights

Individuals retain the right to object to processing under recognised legitimate interests

Legislation

Data (Use and Access) Act 2025, amending UK GDPR Article 6

ICO summary of DUAA changes (opens in a new tab)
Assess your DPO or SRI requirement
If your business currently has a Data Protection Officer (DPO) or was considering appointing one, the DUAA introduces the Senior Responsible Individual (SRI) as an alternative for some organisations. Public authorities must still appoint a DPO.
Senior Responsible Individual (SRI)

The ICO is still developing detailed guidance on when the SRI applies versus the DPO. Monitor ICO updates before making changes to your governance structure.
The DUAA 2025 introduces the concept of a Senior Responsible Individual (SRI) as an alternative to the Data Protection Officer (DPO) for certain organisations. The SRI must be a senior member of the organisation's management team, accountable for data protection compliance.

In force from

5 February 2026

SRI requirement

Must be a senior member of management, accountable for data protection compliance

Public authorities

Must still appoint a DPO (SRI is not available as an alternative for public authorities)

Large-scale monitoring or special category processing

ICO is developing guidance on whether SRI or DPO is required in these cases

Key difference from DPO

SRI is embedded in senior management; DPO must operate independently and cannot be penalised for performing their tasks

When SRI may replace DPO

The ICO is developing detailed guidance on exactly when an organisation may appoint an SRI instead of a DPO. The intention is to reduce the administrative burden on smaller organisations while maintaining accountability.

When DPO is still required

Public authorities and bodies (except courts acting judicially)

Other circumstances to be specified by ICO guidance

ICO DUAA summary of changes (opens in a new tab)
Update your cookie consent
One of the most practical changes: first-party analytics cookies can now be set without prior consent, provided you meet three conditions. Review your cookie banner and consent mechanism.

Cookie consent and ePrivacy compliance

How to comply with cookie consent rules, including the new DUAA analytics cookie exemptions.
DUAA cookie consent exemptions

Only first-party analytics cookies qualify. Advertising, tracking, and third-party cookies still require consent.
From 5 February 2026, the DUAA 2025 amends PECR Regulation 6 to exempt certain analytics cookies from the prior consent requirement. This does not apply to advertising, tracking, or third-party cookies.

Exemption scope

First-party analytics and statistics cookies only

In force from

5 February 2026

Condition 1: Purpose

Cookies must be used solely to collect aggregate statistics about website or app usage

Condition 2: Information

Clear information must be provided to users about the cookies and their purpose

Condition 3: Opt-out

A simple, free mechanism to opt out must be offered to users

What remains unchanged

Advertising and targeting cookies still require prior consent

Third-party analytics cookies still require prior consent

Strictly necessary cookies remain exempt (as before)

The UK GDPR’s requirements for lawful basis still apply to any personal data collected via analytics cookies

This aligns UK law with how the ICO was already enforcing cookie rules in practice.

ICO guidance on storage and access technologies (cookies) (opens in a new tab)
Review your marketing compliance

The DUAA has dramatically increased the maximum penalty for PECR breaches (nuisance calls, spam emails, cookie violations). Businesses that rely on electronic marketing should review their practices urgently.

PECR penalty increase

This 35-fold increase in maximum penalties means electronic marketing compliance is now as serious as UK GDPR compliance.

From 5 February 2026, the DUAA 2025 aligns PECR enforcement penalties with UK GDPR levels. This is a significant increase in the ICO’s enforcement powers for electronic marketing and cookie breaches.

Previous PECR maximum fine

£500,000

New PECR maximum fine (from 5 February 2026)

£17.5 million or 4% of annual worldwide turnover (whichever is higher)

Increase factor

35x increase in maximum penalty

Applies to

All PECR breaches including nuisance calls, spam emails/texts, unsolicited fax marketing, and cookie compliance failures

In force from

5 February 2026

What this means for businesses

Organisations that send unsolicited marketing communications or fail to comply with cookie rules now face the same maximum penalties as for UK GDPR breaches. The ICO has signalled that this alignment reflects the seriousness of privacy intrusions from nuisance communications.

Practical impact: Businesses should review their marketing consent practices, TPS/CTPS screening, and cookie consent mechanisms urgently.

ICO DUAA guidance for organisations (opens in a new tab)
Update your privacy notices and policies

With new lawful bases, governance changes, and cookie exemptions, your privacy notice likely needs updating. Review it against the current requirements.

Data protection for businesses

The complete guide to UK GDPR compliance, including the seven principles, lawful bases, and ICO registration.

DUAA compliance action checklist

Reviewed the 8 key DUAA changes and their impact on your business Assessed whether recognised legitimate interests apply to any of your processing Determined whether you need a DPO, SRI, or neither Updated cookie consent mechanism to reflect analytics exemption (if applicable) Reviewed electronic marketing practices against increased PECR penalties Checked automated decision-making processes have appropriate safeguards Updated privacy notice to reflect any changes to lawful bases or processing Monitored ICO website for ongoing DUAA guidance updates

Stay informed

The DUAA is being implemented in phases, with final provisions expected by June 2026. The ICO is publishing updated guidance as each phase commences.

ico.org.uk

https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/ (opens in a new tab)

Prepare for the Data Use and Access Act 2025 changes

What is the Data Use and Access Act 2025?

Understand the 8 key changes

Data Use and Access Act 2025: what changed for businesses

Review your lawful bases

Assess your DPO or SRI requirement

Update your cookie consent

Cookie consent and ePrivacy compliance

Review your marketing compliance

Update your privacy notices and policies

Data protection for businesses

Stay informed

https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/ (opens in a new tab)

Related journeys

Marketing compliance: PECR and UK GDPR

Respond to a data breach

Understanding UK GDPR from scratch

Handle a data subject access request