UK Data Use & Access Act 2025 — Compliance Guide

UK DUA Act 2025 Compliance Guide — What Changed and What You Must Update

The DUA Act 2025 does not replace UK GDPR — it amends it. The changes are targeted but significant: certain processing activities no longer need balancing tests, some cookie consent requirements are relaxed, and the rules on automated decision-making are modified. This guide identifies what you need to update and what stays the same.

• Recognised Legitimate Interests: Which processing activities now qualify for the new "recognised legitimate interests" — no balancing test required
• Cookie Consent Changes: Analytics and statistical cookies — new reduced consent requirements and how to implement them correctly
• Automated Decision-Making: Changes to Art. 22 equivalent — new rules for decisions with significant effects on individuals
• International Transfers: New transfer mechanisms and adequacy assessment changes — simplified but different from EU approach
• Information Commission Restructure: The new governance model — what it means for enforcement priorities and approach
• Privacy Notice Updates: Which sections of your privacy notice need amendment to reflect DUA Act changes
• DPA Template Updates: Data Processing Agreement amendments needed for new UK-specific provisions
• EU Divergence Analysis: Where UK GDPR now diverges from EU GDPR — critical for organisations operating in both jurisdictions

⚠️ Legal disclaimer (COMPLIANCE): This product is provided for information and compliance documentation only; it is not regulatory advice. Read the full disclaimer below or in our Terms of Service before purchase.

NIS2 / UK CS&R Bill Annex I Coverage Mapping

The UK Data Use & Access Act 2025 sits alongside the upcoming UK Cyber Security & Resilience Bill (the UK's NIS2 equivalent). This guide maps DUA Act compliance work to NIS2 Annex I cybersecurity risk-management measures so organisations can prepare for both simultaneously without duplication:

• (a) Risk analysis + security policy — DUA Act personal data processing risk register cross-mapped to NIS2 risk policy templates
• (b) Incident handling — ICO breach notification (72h) + future CS&R Bill cyber incident notification (likely 24h) joint workflow
• (c) Business continuity — Smart data framework continuity (DUA Act Part 3) aligned with NIS2 BCP requirements
• (d) Supply chain security — Smart data scheme participant due diligence aligned with NIS2 Article 21(d) ICT supply chain controls
• (e) Network + information system security — Smart data API security baselines, secure data sharing architecture
• (g) Cyber hygiene + training — Combined DUA Act + future CS&R Bill staff training module (covers PECR, GDPR, and cyber resilience)
• (h) Cryptography + encryption — Encryption baselines for smart data scheme participants (TLS 1.3, key management)
• (i) Access control — Subject access request workflow + privileged access management aligned with both regimes
• (j) Multi-factor authentication — MFA enforcement requirements for smart data scheme platforms and accountable bodies

Article 23 incident reporting: Pre-filled 24-hour early warning and 72-hour formal incident notification templates aligned with the CS&R Bill's expected reporting windows. Single workflow covers ICO notification (DUA/UK GDPR), NCSC notification (CS&R Bill), and impacted-party communication.