The Data Use and Access Act 2025 (DUAA) updates UK data protection law. It is designed to help organisations use personal data responsibly while protecting people’s rights. Most of the changes give organisations more flexibility, rather than adding new legal duties.
The Act updates the UK GDPR and the Data Protection Act 2018. It does not replace them.
Key changes at a glance
‘Soft opt-in’ for charities
Charities can send electronic marketing to people who have supported them or shown interest in their work, unless the person says no. This makes it easier to keep supporters informed while still respecting their choices.
Recognised legitimate interests
For certain activities — such as protecting public security — organisations can process personal data without carrying out a full balancing test. This reduces paperwork where the public benefit is clear.
Sharing information for public tasks
Organisations can share personal information with bodies such as the police to support their work. The organisation requesting the data is responsible for deciding whether it is necessary, easing the burden on the organisation holding the information.
Re-using personal data
Some new uses of personal information are treated as compatible with the original purpose. This includes disclosures in the public interest, even if the data was first collected for another reason. It allows organisations to respond to changing needs more easily.
Subject Access Requests (SARs)
Organisations only need to carry out reasonable and proportionate searches when responding to requests for personal data. This sets clearer expectations while keeping access rights in place.
Children and online services
If your organisation runs online services likely to be used by children, you must consider their needs when collecting and using data. Children’s safety and rights must be a priority.
Data protection complaints
Organisations must make it easier for people to complain. Complaints must be acknowledged within 30 days and handled without unnecessary delay.
Learn more: GOV.UK – Data (Use and Access) Act 2025
Need support? Contact our Core Services Team on 0191 323 2040 or development@voda.org.uk for advice on compliance.
