← All posts
UK data law: recent milestonesUK legislation
The Data (Use and Access) Act 2025: what changed for UK businesses
The Data (Use and Access) Act received Royal Assent in June 2025, the biggest change to UK data protection law since Brexit.
Headline changes
- A list of recognised legitimate interests that need no balancing test (such as crime prevention and safeguarding).
- A duty to have a complaints process for data subjects.
- Changes to rules on automated decisions and some cookies.
What hasn't changed for data deals
Commercial licensing isn't a recognised legitimate interest, so the full assessment still applies, and de-identification standards remain.
Key takeaways
- Big reform, phased in over time.
- Commercial data licensing still needs a full assessment.
- Take advice on what's in force when you act.
Sources
- Data (Use and Access) Act 2025, legislation.gov.uk
What could your company's records earn?
A free, nine-question estimate. No files, no logins.
More in Privacy & law
Data brokers and national security: what the UK government is asking
DSIT's 2025 call for evidence asked how brokers keep data away from hostile actors. What it covered, and the checks every broker should run now.
Personal data that must never leave: a checklist
Special category data, criminal records, children's data and more: what to exclude before any data deal.
The motivated intruder test, step by step
The ICO's benchmark for whether de-identified data is safe: a determined, competent person with no special access.