UK Information Office Outlines Requirements for Data Use Act
The U.K. Information Commissioner's Office (ICO) June 19 published information to help businesses and the public as changes under the new U.K. Data Use and Access Act 2025 (DUAA) are introduced (see 2506100003).
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
Among other changes, DUAA lifts restrictions on some automated decision-making, sets out how to use some cookies without obtaining consent, requires organizations to develop complaints procedures for data protection and introduces a lawful data processing basis of recognized legitimate interests, the ICO said.
The law also gives the ICO a new name, the Information Commission, and additional powers, such as the ability to compel witnesses to appear for interviews, request technical reports and issue fines of up to £17.5 million, or 4% of global revenue, under the Privacy and Electronic Communications Regulations.
In addition, there are outlines of what DUAA means for companies and law enforcement agencies and a detailed summary of the changes for data-protection experts. There's also a new and planned guidance web page, a discussion of how the office will continue its regulatory work as the different parts of the act are implemented, and a guide for members of the public on how DUAA will affect them.
It recommended that companies familiarize themselves with the changes to data-protection law. When companies provide online services children are likely to use, organizations must ensure they're doing enough to satisfy the new explicit requirement to consider children's needs.
Companies should also start thinking about how they can help people make complaints, the office added.
Most provisions of DUAA are expected to take effect either two or six months after the June 19 Royal Assent, with some taking up to 12 months, the ICO said.