Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 11 JULY 2025

Market Intelligence Thought Leadership Award Winner

The UK's Data (Use And Access) Act 2025: Key Points To Note For Businesses

Sheppard
Sheppard
Contributor
Sheppard

Sheppard

Businesses turn to Sheppard to deliver sophisticated counsel to help clients move ahead. With more...

View firm profile
Explore more from Sheppard

On 11 June 2025, the UK Parliament passed the Data (Use and Access) Act 2025 ("DUAA"), which received Royal Assent on 19 June 2025.

United KingdomPrivacy
Oliver Heinisch
Oliver Heinisch
Charles Corbusier
Charles Corbusier
Author LinkedIn connections

On 11 June 2025, the UK Parliament passed the Data (Use and Access) Act 2025 ("DUAA"), which received Royal Assent on 19 June 2025. This legislation marks a significant and targeted overhaul of the UK's data protection framework, introducing reforms of the UK GDPR, the Data Protection Act 2018 (DPA), and the Privacy and Electronic Communications Regulations 2003 (PECR). In addition, it lays the groundwork for future regulation of AI, launches new initiatives to support smart data access and the development of a digital identity infrastructure.

While the DUAA is not yet fully in force, it sets the stage for a phased implementation. A limited number of provisions took effect immediately upon Royal Assent, most notably those concerning Data Subject Access Requests (DSARs). Different parts of the Act will come into effect on dates to be established by Commencement Orders which will be issued by the Secretary of State. The first of these is expected in October 2025.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

ICO Cookie Crackdown 2.0: The ICO’s New Storage And Access Technologies Guidance

The UK Information Commissioner's Office has finalized its guidance on storage and access technologies, expanding compliance requirements beyond traditional cookies to include tracking pixels, device fingerprinting, and web storage. Organizations must now navigate stricter consent standards and three new narrow exceptions introduced by the Data (Use and Access) Act 2025, while facing significantly increased enforcement penalties of up to £17.5 million or 4% of annual worldwide turnover.
United KingdomPrivacy
ZwillGen
ZwillGen
Article

European Commission Press Release: EU AI Act Transparency Enforcement Starts This Sunday! Do You Know Who Your Chatbots Are? We Break Down The Commission’s Guidelines On Transparency Below

The European Commission has announced that EU AI Act transparency rules take effect August 2, 2026, requiring chatbots to identify themselves, deepfakes to be labeled, and AI-generated content to be marked. Organizations must assess whether their AI systems trigger disclosure, labeling, or content-marking requirements, with limited exceptions and penalties reaching €15 million or 3% of global turnover for noncompliance.
GlobalPrivacy
Seyfarth Shaw LLP
Seyfarth Shaw LLP
Article

ICO Consults On Draft Guidance On Anonymisation And Pseudonymisation For Research

The Information Commissioner's Office has launched a consultation on draft guidance addressing anonymisation and pseudonymisation for research, archiving and statistical purposes. This guidance provides critical insight into how organisations should apply data minimisation principles in modern research practices, including AI development, trusted research environments, and synthetic data generation.
United KingdomPrivacy
Burges Salmon LLP
Burges Salmon LLP
Article

ICO Launches Consultation On Draft Guidance Regarding Anonymisation And Pseudonymisation For Research Purposes

The UK's Information Commissioner's Office has opened a public consultation on draft guidance addressing anonymisation and pseudonymisation techniques for processing personal data in research, archiving, and statistical contexts. The guidance explores critical distinctions between anonymous and pseudonymous data, outlines required safeguards under UK GDPR, and examines emerging technologies including synthetic data and privacy-enhancing tools.
United KingdomPrivacy
A&O Shearman
A&O Shearman
Article

FDA Balances Peptide Policy With Enforcement Against Unlawful Peptide Sellers

Over the past year, industry has had a front row seat as the Food and Drug Administration (“FDA” or the “Agency”) decides just how much leeway it wants to afford the manufacture, marketing, and sale of peptide products, and just where it wants to draw the line. Despite the recent decision of FDA’s Pharmacy Compounding Advisory Committee (“PCAC”) to recommend a number of peptides for inclusion on the 503A bulks list process — a move that represents a potentially more permissive stance toward peptide regulation, at least in terms of what can and cannot be compounded under 503A...
United StatesFood, Drugs, Healthcare, Life Sciences
Sheppard
Sheppard
Article

The Ninth Circuit Affirms Dismissal Of DMCA CMI Removal Claim Against AI Code Generator – Output Is A New Work Not A Copy Of Training Data

There was a significant ruling in the Doe v. Github case involving training of AI code generator models on open source. The United States Court of Appeals for The Ninth Circuit affirmed the district court ruling dismissing part of an action brought under the Digital Millennium Copyright Act (“DMCA”) by programmers against GitHub, Inc., and other defendants. The issues centered on whether defendants removed copyright management information (CMI) from content used to train the AI code generator models.
United StatesIntellectual Property
Sheppard
Sheppard
Article

Massachusetts Issues Guidance On Data Center Development Under Executive Order 658

Massachusetts Governor Maura Healey has issued Executive Order 658, establishing comprehensive permitting and regulatory standards for data centers exceeding 25 MW of peak electricity demand. The Order mandates community benefits agreements, clean energy procurement protocols, and coordination across multiple state agencies to ensure responsible development that protects ratepayers, communities, and the environment. This action positions Massachusetts alongside other states implementing stricter oversight o
United StatesEnergy and Natural Resources
Sheppard
Sheppard
Article

Fintech Agrees To Acquire National Bank Partner For $590 Million

A publicly traded fintech company has announced a $590 million acquisition of its longtime national bank partner, marking a strategic shift from the traditional bank-partnership model to direct ownership of a national bank charter. The transaction, expected to close in the first half of 2027 pending regulatory approvals, would make the fintech a bank holding company while consolidating its banking activities and eliminating certain sponsor-bank fees. This deal represents a faster alternative to pursuing a d
United StatesFinance and Banking
Sheppard
Sheppard
Article

Treasury Proposes GENIUS Act Rules For Stablecoin Issuance And Sales

On August 18, the U.S. Department of the Treasury published a notice of proposed rulemaking to implement Section 3 of the Guiding and Establishing National Innovation for U.S. Stablecoins Act (GENIUS Act). The proposal would establish rules governing who may issue payment stablecoins in the United States and when digital asset service providers may offer, sell, or otherwise make payment stablecoins available to U.S. persons. Comments are due October 19, 2026.
United StatesFinance and Banking
Sheppard
Sheppard