Legislation / ActUnited Kingdom

Data (Use and Access) Act 2025 (DUAA 2025)

Reforms aspects of UK data protection, including a 'recognised legitimate interests' basis, ADM rules, cookie-consent changes and the move to an Information Commission.

Verify current status

Commencement is staged; exact in-force dates are set by commencement regulations — confirm on legislation.gov.uk and the ICO.

Classification

Legislation / Act

Issuing authority

UK Parliament

Jurisdiction

United Kingdom · Sector: All

Status / edition

Enacted; provisions commencing in stages

Key dates

Royal Assent 19 June 2025; staged commencement through 2025-2026

Mandatory or voluntary

Conditional

Who it applies to

Amends (does not replace) UK GDPR, the DPA 2018 and PECR.

Purpose

Reforms aspects of UK data protection, including a 'recognised legitimate interests' basis, ADM rules, cookie-consent changes and the move to an Information Commission.

Major requirements / obligations

  • Track amended UK GDPR/DPA provisions
  • Revisit cookie consent and PECR
  • Prepare for the Information Commission

Control domains

PrivacyGovernance

Last reviewed

2026-10-18 (source verification date)

This library provides general information for orientation only. It is not legal advice, a determination of applicability, or a substitute for formal certification or professional counsel. Verify current legal status, editions and dates against the official source before relying on any entry. Inclusion of a jurisdiction or instrument here is informational and does not imply that Srida IT provides regulated services, holds local authorisation, or has a presence in that jurisdiction.