Data Use and Access Act
Book Free Consultation ›
The Data Use and Access Act 2025 (DUAA) is a new Act of Parliament that updates some laws relating to digital information and is being phased in between June 2025 and June 2026. This includes a number of changes to the UK’s data protection and privacy regulatory landscape. While it does not replace the UK GDPR, the Data Protection Act 2018, or PECR, it amends them to provide greater clarity and flexibility in data use, particularly for research, innovation, and public interest, while maintaining strong privacy protections. It also introduces some new requirements that organisations may need to take into account.
At Evolve North, we help organisations navigate these changes with confidence. We can support you to review your current Data Protection and privacy practices and policies to make sure these continue to be in line with the changes being introduced by the DUAA ensuring continued compliance with legislation moving forward.
Who Does this Affect?
If you are an organisation that is subject to Data Protection laws or the Privacy and Electronic Communications Regulations e.g. because you process personal data, carry out direct marketing, or use cookies on your website, then the Data Use and Access Act may change the way you currently comply.
Changes introduced by the DUAA will impact a range of organisations including:
- Organisations processing personal data
- Public authorities, charities, and private companies
- Organisations using personal data for research, statistical, public interest and public task purposes
- Businesses relying on cookies, direct marketing, or automated decision-making
Why DUAA Compliance Matters
- Legal Alignment: Ensures continued compliance with UK GDPR, DPA 2018, and PECR under the new legal framework
- Operational Clarity: Provides clearer rules on data subject rights, lawful bases, international transfers, automated decision making, direct marketing and cookies use
- Regulatory Risk: Non-compliance may lead to ICO enforcement, including fines up to £17.5 million and introduces new enforcement powers for the Information Commissioner
- Soft opt in: Provides more flexibility for charities to promote their organisation without consent
- Appropriate complaints handling: Implements more robust processes for handling complaints relating to personal data use
- Children: Ensures that children’s data is appropriately protected
How we can help
Our DUAA Consultancy and Support Process
- Discovery Workshop We assess your data practices, lawful bases, and risk exposure under the DUAA.
- Gap Analysis We benchmark your current compliance against DUAA requirements and identify areas for improvement.
- Action Plan You receive a tailored roadmap with practical steps to align with the new legal obligations.
- Implementation Support We help you revise documentation, train staff, and embed DUAA-compliant processes.
- Ongoing Advice Stay ahead of regulatory developments with our continuous support and updates.
Why Choose Evolve North?
- We have deep expertise in UK data protection law, cyber security, and governance
- We have a proven track record across sectors including healthcare, finance, legal, and education
- We offer practical, risk-based advice tailored to your operational context
- We deliver clear, actionable reporting and hands-on implementation support
- We are trusted by organisations seeking long-term data governance resilience
Arrange a FREE Consultation
Evolve North’s DUAA consultancy service helps you understand and implement the latest legal requirements under the Data Use and Access Act 2025. In a free consultation, we’ll explore how the changes may affect your organisation and outline the tailored support we can provide to help you manage risk, maintain compliance, and make the most of your data with confidence.