Data (Use and Access) Act 2025

As noted previously, the Data (Use and Access) Act 2025, which updates key aspects of data protection law, has received Royal Assent. Changes include clarifying how personal information can be used for research; lifting restrictions on some automated decision making; setting out how to use some cookies without consent; allowing charities to send people electronic mail marketing without consent in certain circumstances; requiring organisations to have a data protection complaints procedure and introducing a new lawful basis of recognised legitimate interests.

The Act provides the Information Commissioner’s Office with new powers, including the ability to compel witnesses to attend interviews, request technical reports, and issue fines of up to £17.5 million or 4% of global turnover under the Privacy and Electronic Communications Regulations.

The ICO has published information to support organisations and the public as these changes are introduced. It includes: Continue reading →