Authors
Authors
After receiving Royal Assent on 19 June 2025, the Data (Use and Access) Bill (DUA Bill) has become the Data (Use and Access) Act (DUA Act), and here is what you need to know.
Background to the DUA Act
The long-awaited DUA Bill finally passed through UK Parliament on 11 June 2025 following a lengthy period of ‘ping pong’ between the House of Commons and the House of Lords until both chambers eventually reached agreement on the DUA Bill’s wording. The DUA Bill received Royal Assent last week and this new legislation will reform some elements of the UK’s data protection laws (which we have reported on here).
Delay to the DUA Act’s passing had been due to proposed amendments put forward by the House of Lords seeking to restrict use of copyright materials and data used for training of AI models and to impose requirements of transparency. The Government argued that the DUA Act was not the appropriate legislation for this complex issue to be addressed, and a compromise position was ultimately found with the Government agreeing to publish a report on its copyright and AI proposals, including on enforcement measures, within nine months of the date of Royal Assent.
While the debate over protection of copyright and the UK’s valuable creative sector in the age of AI will continue for some time, the DUA Act brings potential to grow the UK’s information and AI economy and for businesses to realise value in smart data. In alignment with the Government’s AI Opportunities Action Plan (which have reported on here) and Prime Minister Starmer’s ambition for the UK to become an “AI maker not an AI taker“, the Government’s key objectives are to:
- harness the power of data to grow the economy;
- make peoples’ lives easier; and
- improve public services and enable modern digital government.
Key elements of the DUA Act
1. Growing the economy: access to data through smart data schemes
Smart data schemes are intended to enable the secure sharing of customer data, on the customer’s request, with authorised third-party providers who use that data to provide services and “smart tools” for consumers and businesses. The Government hopes that these smart data schemes will provide opportunities for organisations to expand, promoting competition and growth across industries and sectors, such as energy.
For businesses and individuals, the DUA Act promises streamlined interactions with financial services, allowing for simplified and more secure data sharing. The success of smart data schemes is evident from the early pioneer of open banking, which allows banks to share personal data with authorised third parties, such as Experian, mortgage providers and investment services. The Government hopes that smart data schemes will boost the economy by £10 billion.
2. Making lives easier: digital verification services
A key objective is to make peoples’ lives easier by streamlining processes that are often time consuming and difficult for those unfamiliar with advanced technology. With this objective in mind, the DUA Act enables the Secretary of State to publish a “trust framework” of rules for digital identity verification services (DVS) to simplify part of lengthy processes such as rental agreements, job applications and accessing public services and reduce administrative hurdles for individuals. Organisations that provide DVS tools will be able to become certified and receive a trust mark for use.
In addition, the DUA Act promotes digitalisation of essential records, such as birth and death registrations, taking a further step towards reducing the nation’s paperwork and administration, alongside improving accessibility and efficiency in obtaining such records.
3. Improve public services: other provisions about use of or access to data
Continuing the objective of streamlining processes and improving efficiency in services, the DUA Act focuses on assisting public services in their data handling and accessibility. In the NHS, the DUA Act aims to improve patient outcomes by creating more accessible and organised heath data systems for medical professionals and NHS administrators, allowing for them to access the relevant medical information on a timely basis.
This also creates an opportunity to interlink with the police and law enforcement agencies, minimising administrative burdens. The Government hopes this will save up to 1.5 million hours annually, allowing for police officers to allocate more time to tackling crime and community issues.
Together, the Government estimates these advancements will save taxpayers up to £42.8 million annually.
4. National Underground Asset Register
The National Underground Asset Register will digitalise mapping of underground utilities and aims to assist over 600 gas, water, electric, telecommunications companies and local authorities and contribute an estimated £400 million annually to the UK economy.
5. Changes to UK data protection law and EU adequacy
The DUA Act introduces several reforms aimed at enhancing data protection, governance and innovation which we have reported on here. The Government has had to address concerns that reforms to data protection law may lead to revocation of the UK’s adequacy status which allows businesses in the UK and EU to transfer personal data. Revocation of the adequacy decision would create a significant burden and cost for organisations which share data across the UK and EU.
Earlier this year the EU extended its adequacy decision for the UK until 27 December 2025. It remains to be seen whether changes to the UK’s own international data transfer regime (along with other UK legislation including Investigatory Powers Act and legal mechanisms relating to Technical Capability Notices to undermine encryption) may cause a problem for the renewal of the UK’s adequacy decision.
What action should businesses take now?
Changes to the data processing elements are likely to come into effect quickly following Royal Assent so businesses should be ready to review their data protection processes.
Those wishing to take advantage of the changes in relation to scientific research and using data for further processing are likely to want to understand what the changes in the DUA Act will mean for them.
The wider opportunities to unlock value in data will be dealt with by secondary legislation. We recommend keeping a watching brief.
Our experienced Data Protection & Privacy team is on hand to answer any questions you may have in relation to the changes resulting from the new legislation.