Dechert Cyber Bits Issue - 78 - June 26, 2025

UK Passes Data (Use and Access) Act 2025 Reforming UK Data Protection Laws

Having been passed by Parliament and receiving Royal Assent on June 19, 2025, the Data (Use and Access) Act (the "DUA Act") is now law, reforming the existing UK GDPR and Privacy and Electronic Communications Regulations. The DUA Act maintains the UK's existing data protection framework but introduces targeted refinements to reduce the compliance burden in respect of certain obligations. It introduces, amongst other things:

• new legal bases for data processing under "recognized legitimate interests" (for which organizations would not need to carry out a legitimate interest assessment);
• a more flexible test for "adequacy" for the purposes of assessing whether personal data can be transferred out of the UK, which is likely to result in "adequacy" decisions for more countries;