Data (Use and Access) Act

The Data (Use and Access) Act 2025 (DUAA) is a landmark piece of legislation designed to modernise the UK’s data regime, following the country’s departure from the European Union. Its primary objective is to unlock the economic potential of data by simplifying its use in public services and the private sector, while maintaining high standards of data protection. 

For Britain’s startup and innovation ecosystems, the Act introduced several pivotal changes. A core component is the provision to enable the growth of Smart Data schemes. Building on the success of Open Banking, these will allow customers to safely share their data with authorised third-party providers in sectors such as energy, telecommunications, and finance — opening up the opportunity for startups to provide innovative comparison tools, switching services, and personalised financial products.

The Act also clarifies that scientific research may include commercial research. It stipulates that people can give ‘broad consent’ to an area of scientific research, and enables the re-use of people’s personal information for scientific research without requiring them to be given a privacy notice if that would involve a disproportionate effort.

The Act also introduces a risk-based approach to Automated Decision-Making — distinguishing between low-risk and high-risk use cases). This grants organisations the ability to use automation more widely in low-risk scenarios, which comprise the majority of ADM uses.

Further reading

• Information Commissioner’s Office — The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations?

• Department for Science, Innovation and Technology — Data (Use and Access) Act 2025

• techUK — Data (Use and Access) Bill Passes, Ushering in New Era for UK Innovation