Data Use and Access Act 2025: What Changes for UK Businesses
The Data (Use and Access) Act 2025 is the biggest update to UK data protection law since Brexit. It does not replace UK GDPR, but it changes how you handle cookies, marketing, complaints and subject access requests, and it raises the stakes for getting email and text marketing wrong. Here is what small UK businesses need to know and do.
Key takeaways
- The Act received Royal Assent on 19 June 2025 and its provisions are being switched on in stages, so check the ICO guidance on what is in force.
- Fines for breaking the marketing and cookie rules (PECR) rise to UK GDPR levels: up to £17.5 million or 4% of global turnover.
- Some low-risk cookies, such as analytics, may no longer need consent, but you still need to tell people and offer a way to refuse.
- You need a clear process for handling data protection complaints.
- Subject access searches only need to be "reasonable and proportionate", and the clock can pause while you ask for clarification.
If you run a small business in the UK, you already live with two sets of data rules. UK GDPR and the Data Protection Act 2018 govern how you collect and use personal data. The Privacy and Electronic Communications Regulations (PECR) govern marketing emails, texts, calls and cookies. The Data (Use and Access) Act 2025, often shortened to DUAA, amends both rather than starting from scratch.
That is good news: most of what you already do stays valid. Your lawful bases, privacy notice, security measures and breach procedures still matter in the same way. The Act adjusts specific points, some in your favor and some that raise the cost of mistakes. This guide walks through the changes most likely to affect a small business, in order of how often they come up.
A quick note before we start: this is general information, not legal advice. The Act is being commenced in stages, and the Information Commissioner's Office (ICO) is updating its guidance as each part takes effect. Check the ICO website for what is in force on the day you act, or speak to a qualified adviser for anything high-stakes.
What the Act is, and when it applies
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. Unlike a single "go-live" date, its provisions are being commenced in stages through regulations. Some parts apply already; others depend on further secondary legislation or ICO guidance.
For a small business, this staged approach means you should not rush to change everything at once. Instead, note the areas that affect you, check the ICO's current guidance on each, and update your documents as each change takes effect. The sections below tell you where to look.
Common mistake
Assuming the Act "relaxed GDPR" and you can now do what you like with data. The core principles are unchanged: you still need a lawful basis, transparency, security, data minimization and respect for people's rights. The changes are targeted, not a rollback.
Higher fines for marketing and cookie breaches
For years, the maximum fine under PECR was far lower than under UK GDPR. That gap was one reason some businesses took a relaxed view of email consent, cold texting and cookie banners. The Act closes the gap.
Few small businesses will ever face a fine anywhere near that ceiling, and the ICO considers the size of the organization and the harm caused. But the signal is clear: unsolicited marketing and careless cookie practices are now treated as seriously as other data protection failures. If your marketing relies on emailing lists you bought, texting people who never agreed, or setting advertising cookies before anyone clicks "accept", now is the time to fix it.
The underlying PECR rules have not changed much. Marketing emails and texts to individuals, including sole traders and some partnerships, still need prior consent unless the soft opt-in applies. Corporate subscribers, such as companies and LLPs, can be emailed without consent, but you must identify yourself and offer an opt-out, and UK GDPR still applies to named employee addresses. Every message needs a simple, free way to unsubscribe.
Pro tip
Run a quick audit of every list you send to. For each one, write down where the contacts came from and which rule you rely on: consent, soft opt-in or corporate subscriber. Any list where you cannot answer is a list you should stop using until you can.
Cookies: some low-risk uses get easier
Cookie banners have been one of the most visible and most disliked parts of UK data law. The Act relaxes the consent requirement for certain low-risk cookies and similar technologies. Analytics cookies used to improve your own website are the example most often given, along with some cookies that support functionality such as remembering a user's choices.
Three things stay the same, and they are easy to overlook:
- Transparency still applies. You must tell people what cookies you use and why, usually in a cookie notice or privacy notice.
- People must be able to object. For cookies that no longer need consent, you still need to give a simple way to refuse.
- Advertising and tracking cookies still need consent. Cookies used for targeted ads, cross-site tracking or sharing data with ad networks are not in the low-risk group.
Because the details depend on commencement and ICO guidance, phrase your own changes cautiously. If your website builder or consent platform offers a "UK analytics exemption" setting, read the ICO guidance before switching it on, and check that your analytics tool is configured in the low-risk way the guidance describes.
Example
Imagine a small bakery, Crumb & Co, whose website uses a basic analytics tool and a social media advertising pixel. After checking the ICO guidance, the owner moves the analytics tool into a category that no longer asks for consent, adds a clear explanation and an opt-out link to the cookie notice, and keeps the advertising pixel blocked until a visitor accepts. The banner becomes simpler, but the ad pixel stays behind consent.
Recognised legitimate interests
Under UK GDPR, "legitimate interests" is one of the six lawful bases for processing personal data. Normally you must carry out a balancing test, weighing your interest against the person's rights. The Act adds a list of "recognised legitimate interests" where that balancing test is not required.
The recognised list is aimed at public interest purposes, such as responding to an emergency, safeguarding vulnerable people, preventing crime and national security. For most day-to-day business activities, such as marketing, customer service or analytics, you will still rely on ordinary legitimate interests with a documented balancing test, or on consent or contract.
The Act also clarifies that certain activities, including direct marketing and sharing data within a group of companies, can be legitimate interests. That clarification is helpful, but it does not override PECR. If the marketing is by email or text to individuals, you still need consent or the soft opt-in.
A complaints process becomes a requirement
One practical change is that organizations must have a process for handling data protection complaints. Before, many people complained straight to the ICO. Now the expectation is that you give people a way to complain to you first, acknowledge their complaint and deal with it.
For a small business, this does not need to be complicated. A complaints process can be as simple as these steps:
- Give people a route. Name an email address or a simple online form for data protection complaints in your privacy notice.
- Acknowledge promptly. Confirm you have received the complaint. Check the ICO guidance for the expected timescale once this part is in force.
- Investigate. Work out what happened, which data was involved and whether you got something wrong.
- Respond and fix. Tell the person what you found and what you are doing about it, and correct the underlying issue.
- Keep a record. Log each complaint, the outcome and the date, so you can show the ICO how you handled it if asked.
Pro tip
Use the same inbox and log for complaints and subject access requests. Both often arrive together, and one shared tracker stops anything slipping through the cracks.
Subject access requests get clearer rules
Subject access requests (SARs) let people ask for a copy of the personal data you hold about them. They have long been a headache for small businesses, especially when a request arrives during a dispute with a former employee or customer. The Act clarifies two points that help.
Searches must be reasonable and proportionate
The Act confirms that you only need to carry out searches that are "reasonable and proportionate". That puts into law what the courts and the ICO had broadly said before. It does not let you skip obvious places, such as your email system or customer database, but it means you are not expected to search every possible device or backup without good reason.
The clock can pause for clarification
You normally have one month to respond, which can be extended by up to two more months for complex or numerous requests if you tell the person within the first month. The Act makes clear that if you reasonably need more information to find the data, the clock can pause while you ask the person to clarify. Ask promptly and keep a note of when you asked and when they replied.
| Area | What changes | What to do |
|---|---|---|
| PECR fines | Raised to UK GDPR levels | Audit marketing lists and consent records |
| Cookies | Some low-risk cookies may not need consent | Check ICO guidance, update cookie notice, keep an opt-out |
| Legitimate interests | New recognised list; marketing confirmed as possible legitimate interest | Keep balancing tests; PECR consent rules still apply |
| Complaints | A complaints process is required | Publish a route, log and answer complaints |
| Subject access | Reasonable and proportionate searches; clock can pause | Update your SAR procedure and templates |
| Research | Easier to use data for research | Seek advice before relying on it |
Other changes worth knowing about
A few more changes are less likely to affect a typical small business but are worth a sentence each.
- Research. The Act makes it easier to reuse personal data for scientific research, including some commercial research. If you plan to rely on this, take advice first, because the conditions are specific.
- Charities and the soft opt-in. The Act extends the soft opt-in to charities, so they can send marketing to supporters in similar ways to businesses. Commencement may be phased, so check before relying on it.
- Automated decisions. The rules on decisions made solely by automated means are being reshaped, with safeguards such as the right to human review. If you use automated tools to make significant decisions about people, such as hiring screens, review the ICO guidance.
The things that have not changed matter just as much. You still need to pay the ICO data protection fee unless you are exempt, report personal data breaches within 72 hours where required, keep personal data secure and keep it no longer than necessary.
Your DUAA action checklist
- Bookmark the ICO's guidance page on the Act and check it each quarter
- Audit every marketing list and record the rule you rely on for each
- Confirm every email and text includes a simple, free unsubscribe
- Review your cookie banner and notice against current ICO guidance
- Keep advertising and tracking cookies behind consent
- Publish a data protection complaints route in your privacy notice
- Set up one log for complaints and subject access requests
- Update your SAR procedure for clarification requests and proportionate searches
- Confirm your ICO data protection fee is paid and up to date
Frequently asked questions
Does the Data Use and Access Act replace UK GDPR?
No. It amends UK GDPR, the Data Protection Act 2018 and PECR. The core principles and individual rights remain, and your existing compliance work still counts.
Can I remove my cookie banner now?
Probably not entirely. Only certain low-risk cookies may be exempt from consent, and you still need to explain them and offer a way to refuse. Advertising and tracking cookies still need consent. Check the ICO guidance before making changes.
Can I now email anyone I like because marketing is a legitimate interest?
No. Legitimate interests is a lawful basis under UK GDPR, but PECR still requires consent or the soft opt-in for marketing emails and texts to individuals. Both sets of rules apply.
Does the Act apply to my business if I also sell into the EU?
The Act applies to your UK processing. If you offer goods or services to people in the EU, EU GDPR and each country's ePrivacy rules may also apply, and they have not changed because of this Act.
Related reading
The bottom line
The Data (Use and Access) Act 2025 is an update, not a revolution. It tidies up subject access requests, eases some cookie rules and requires a complaints process, while making marketing and cookie breaches far more expensive. Audit your lists, review your cookie setup, add a complaints route and update your SAR procedure.
Because the Act is commencing in stages, treat this as a living checklist: check the ICO guidance on what is in force before each change, and ask a qualified adviser if you are unsure.
