The Data (Use and Access) Act 2025: How UK GDPR Changes in 2026

The Data (Use and Access) Act 2025 is the most significant reform to UK data-protection law since the UK GDPR itself, and its provisions are landing in stages through 2026 rather than all at once. Here's what's actually changed so far, and what's still to come.

DUAA vs the Old UK GDPR/DPA 2018 Framework

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025, but rather than replacing the UK GDPR and Data Protection Act 2018 outright, it amends them — introducing a phased set of changes to how organisations can process personal data lawfully, how automated decisions are made, and how international data transfers are assessed. Because commencement is phased, organisations need to track exactly which provisions are already in force rather than assuming the whole Act applies from its Royal Assent date. For the background rules, see our guide to UK GDPR and data protection essentials.

Recognised Legitimate Interests: A New Seventh Lawful Basis

From 5 February 2026, a new lawful basis for processing personal data — "Recognised Legitimate Interests" — took effect. This sits alongside the existing six lawful bases under UK GDPR, but with one significant practical difference: processing that falls within a Recognised Legitimate Interest doesn't require the balancing test that the existing general "legitimate interests" basis demands. In effect, for a defined set of recognised purposes, organisations gain a more straightforward lawful basis to rely on, without needing to weigh their interests against the individual's rights and freedoms each time.

Automated Decision-Making: Articles 22A–22D Replace Article 22

The Act repeals UK GDPR Article 22 — the provision that gave individuals the right not to be subject to decisions based solely on automated processing, including profiling, with significant effects — and replaces it with a new set of provisions, Articles 22A to 22D. The practical effect is a loosening of the previous restrictions on automated decision-making, which matters directly for any organisation using algorithmic or AI-driven decision-making in areas like credit assessment, recruitment screening, or fraud detection. Understanding exactly what's now permitted under the new Articles 22A–22D framework, versus what the old Article 22 restricted, is essential before scaling any automated decision-making process.

International Transfers: A Lower Bar

The Act also changes the test applied to international data transfers. Previously, transfers outside the UK needed to meet a standard of "essential equivalence" to UK data-protection standards. Under the Act, this moves to a "not materially lower" standard — a less stringent test, intended to make it somewhat easier to transfer personal data internationally while still maintaining a baseline of protection. This is a meaningful shift for any UK organisation that regularly transfers data to jurisdictions outside the UK's existing adequacy framework.

The 19 June 2026 Complaints Procedure Requirement

A further provision — a requirement for organisations to operate a mandatory internal complaints procedure before an individual can escalate a data-protection complaint to the Information Commissioner's Office — takes effect on 19 June 2026. This is the next confirmed milestone in the Act's phased rollout after the February 2026 lawful-basis change, and organisations should have a documented internal complaints process in place and ready before that date, rather than relying on an informal or undocumented process.

UK Adequacy Remains Secure

Despite these changes, the EU formally renewed the UK's data-adequacy status through to 27 December 2031, confirming that the UK's reformed data-protection framework, including the changes introduced by this Act, continues to be recognised by the EU as providing an adequate level of protection for personal data transferred from the EU to the UK. This matters significantly for any UK organisation handling EU-origin personal data, since a loss of adequacy would have created substantially more friction for EU-to-UK data flows.

A Phased Compliance Checklist

Given the Act's staged commencement, organisations should track: whether they're relying on (or could benefit from) the new Recognised Legitimate Interests basis from February 2026; whether any automated decision-making processes need reviewing against the new Articles 22A–22D framework; whether international transfer arrangements need reassessing under the new "not materially lower" test; and whether an internal complaints procedure is documented and operational ahead of the 19 June 2026 deadline.

A Note on Overall Direction

Taken together, the changes under this Act move UK data protection in a direction that's slightly more permissive than the previous UK GDPR/DPA 2018 framework — a new lawful basis without a balancing test, a loosened automated-decision-making regime, and a lower bar for international transfers. None of this removes the UK's data-protection obligations, but it does mean organisations that built compliance processes entirely around the old, stricter standards may find some of those processes are now more conservative than the law strictly requires — worth reviewing rather than assuming the old approach is still the only compliant one.

Keeping Data-Protection Knowledge Current

Data protection reform of this scale doesn't happen often, and finance professionals handling personal data — whether payroll, client financial information, or AML-related data — benefit from understanding exactly what's changed and when. Learnsignal's CPD courses track this Act's phased rollout as further provisions come into force through 2026 and beyond.