This page will help you answer some frequently asked questions regarding the new Data Use and Access Act. Read about some of the key changes below.
What is the Data (Use and Access) Act?
The Data (Use and Access) Act (or “DUAA”) is a new piece of UK legislation that aims to upgrade current data protection legislation in the UK (such as the UKGDPR, Data Protection Act 2018 and the Privacy and Electronic Communications Regulation PECR). Its main purpose is to strengthen how data is safeguarded, while not stifling innovation or technological advancement, with the additional goals of improving public services, supporting research, and boosting economic growth.
For public sector organisations, the bill will likely mean clearer guidance and legal backing for sharing data in appropriate ways. It could reduce some of the uncertainty or red tape they currently face when trying to work with other departments or researchers. Over time, this could lead to more collaboration, better decision-making, and improved services. Private and third-sector organisations, especially those working in partnership with government or using public sector data, may see new opportunities as well. The DUAA could open up safer access to anonymised data for research or product development, supporting innovation in areas like healthcare, housing, or education.
However, all organisations handling data will need to ensure they meet high standards for privacy and security, and may need to adapt their practices to align with the new legal framework.
The Act is designed to modernise the legal framework for how personal and non-personal data is accessed, shared, and used across sectors, while maintaining strong protections for individual rights.
While the UK GDPR and DPA 2018 focus primarily on the protection of personal data, the Data Use and Access Act expands the focus to include broader data access mechanisms, including standards for data sharing, use of public sector data, and support for innovation.
No. The Act complements existing data protection legislation rather than replacing it. Organisations still need to comply with the UK GDPR and DPA 2018 where personal data is involved.
The Act applies to public bodies, private organisations handling public sector data, and companies engaged in data-driven innovation. It may also have implications for international companies processing UK data or collaborating with UK public sector bodies.
Organisations will need to review existing data-sharing arrangements, ensure transparency with data subjects, and potentially formalise new documentation and oversight mechanisms.
The Information Commissioner’s Office (ICO) may issue enforcement notices or fines where organisations fail to meet new legal obligations under the Act, particularly where public trust or transparency is compromised.
Guidance is expected from the Department for Science, Innovation and Technology (DSIT) and the ICO. Organisations should also seek legal or consultancy advice to interpret specific obligations and assess impact.
The Act doesn’t directly amend existing international data transfer rules, but global organisations may need to consider how cross-border access and re-use of UK public data is managed in line with the Act’s principles.
Overview
Are you overwhelmed or confused by the many changes introduced in the new Data (Use and Access) Act (DUAA)? Do you need an expert’s guidance on what the various amendments mean, and how this will affect your organisation?
Course contents include:
This course is delivered by the well known industry expert Ralph O’Brien. Ralph delivers many of our training courses.
When you train with us at DPAS, you’ll get more than just the training. We’ll provide you with free policies, templates, and tools after the course has concluded. We will also supply you with the relevant resources to help you throughout.
got a question?
Want to receive a copy of our monthly Data Protection newsletter and news from the DPAS team?
Helping organisations access the value of their data, create a vision, embed the change and build the future.
Please note all information on this website is for your help and guidance. It should not be regarded as an authoritative or definitive statement of the law.
