The Data (Use and Access) Act 2025 has now come into effect, see here
After a number of attempts to amend data protection laws in the UK over recent years, the Data (Use and Access) Act 2025 came into effect in June 2025. The Act supplements and amends existing data protection legislation in the United Kingdom. The Act does not only impact on data protection issues, but covers a wide variety of topics, including access to customer and business data, digital verification services, the establishment of a national underground asset register, and changes to the registers of birth and deaths. The information on our website focuses on the key legislative changes in relation to data protection laws in the UK.
The Data (Usage and Access) Act 2025 introduces a number of key changes to the below data protection topics:
Introduction of a new lawful basis known as ‘Recognised Legitimate Interests’, which may be approved by the Secretary of State from time to time.
As of June 2025, this list includes
Replacing the Information Commissioner’s Office (ICO) with the new Information Commission (IC), who will act as an independent governing body, diverting from the existing corporate-style structure to more of a traditional statutory ‘board’ model.
The Act establishes statutory considerations for data controllers who wish to process personal data for a new purpose, separate from the original purpose for which the data was initially processed.
The Act amends existing legislation, surrounding various aspects of data subjects’ rights, concerning topics including a) reasonable and proportionate searches for personal data, b) timescales for responding to requests, and c) the right to make a complaint to the data controller.
The term ‘adequacy’, as per Article 45 of UK GDPR, will be removed, and replaced with ‘transfers approved by regulations’. This will enable the Secretary of State to approve restricted transfers of personal data to either third countries or international organisations.
The GDPR came into law within all the individual countries in the European Union in 2018. It continues to be the legislation that covers:
Article 3, GDPR
So, if you are a business based in the UK, but you have customers in the EU, the GDPR may apply to you.
The GDPR sets out the statutory responsibility for organisations as to how to lawfully process personal data, including the principles, lawful bases, and data subject’s rights.
Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject
Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes
Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed
Personal data shall be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay
Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject
Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures
The controller shall be responsible for, and be able to demonstrate compliance with the principles.
The data subject has given consent to the processing of his or her personal data for one or more specific purposes;
Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
Processing is necessary for compliance with a legal obligation to which the controller is subject;
Processing is necessary in order to protect the vital interests of the data subject or of another natural person;
Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. This lawful basis shall not apply to processing carried out by public authorities in the performance of their tasks.
Individuals have a right to know what will happen to their personal data when an organisation (known as the Data Controller) processes it. This is normally set out in a Privacy Notice, usually posted on the organisation’s website.
Individuals have a right to access the personal data an organisation holds about them and to have a copy of it. The organisation has one month to provide the personal data from the date of receiving the request.
If an individual believes personal data held about them is incorrect, they have the right to request for it to be amended.
The right to request that personal data held by an organisation is deleted.
This right allows the individual to request that the organisation does not process their personal data.
Individuals have the right to request their personal data be transferred to another Data Controller.
The individual has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.
Following Brexit, the UK GDPR, rather than GDPR, now applies in the UK. This is broadly identical to the GDPR, albeit changes have been introduced in relation to terminology, reflecting the UK’s departure from the EU. The UK GDPR now only applies to:
Article 3, UK GDPR
The United Kingdom and the EEA currently have in place an ‘adequacy’ decision which enables the free-flow of personal data between the UK and the member states of the EEA.
UK GDPR requires that all organisations falling within the scope of the legislation, adhere to the data protection principles, which are the same as the GDPR. It also affords the same rights to individuals and requires an organisation to identify a valid lawful basis in order to process personal data.
Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject
Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes
Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed
Personal data shall be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay
Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject
Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures
The controller shall be responsible for, and be able to demonstrate compliance with the principles.
The data subject has given consent to the processing of his or her personal data for one or more specific purposes;
Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
Processing is necessary for compliance with a legal obligation to which the controller is subject;
Processing is necessary in order to protect the vital interests of the data subject or of another natural person;
Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. This lawful basis shall not apply to processing carried out by public authorities in the performance of their tasks.
Individuals have a right to know what will happen to their personal data when an organisation (known as the Data Controller) processes it. This is normally set out in a Privacy Notice, usually posted on the organisation’s website.
Individuals have a right to access the personal data an organisation holds about them and to have a copy of it. The organisation has one month to provide the personal data from the date of receiving the request.
If an individual believes personal data held about them is incorrect, they have the right to request for it to be amended.
The right to request that personal data held by an organisation is deleted.
This right allows the individual to request that the organisation does not process their personal data.
Individuals have the right to request their personal data be transferred to another Data Controller.
The individual has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.
The UK Data Protection Act 2018 supplements the UK GDPR. The key implications, for the majority of organisations, are
The Data Protection Act also sets out particular processing rules in relation to law enforcement and national security.
The Information Commissioner’s Office is the supervisory authority for data protection in the UK and has powers including issuing reprimands, enforcement notices and monetary penalties to organisations that do not comply with the legislation. The ICO is also the point of contact for individuals’ complaints.
Individuals can also seek judicial remedies for breaches of UK data protection legislation.
Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject
Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes
Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed
Personal data shall be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay
Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject
Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures
The controller shall be responsible for, and be able to demonstrate compliance with the principles.
The data subject has given consent to the processing of his or her personal data for one or more specific purposes;
Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
Processing is necessary for compliance with a legal obligation to which the controller is subject;
Processing is necessary in order to protect the vital interests of the data subject or of another natural person;
Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. This lawful basis shall not apply to processing carried out by public authorities in the performance of their tasks.
Individuals have a right to know what will happen to their personal data when an organisation (known as the Data Controller) processes it. This is normally set out in a Privacy Notice, usually posted on the organisation’s website.
Individuals have a right to access the personal data an organisation holds about them and to have a copy of it. The organisation has one month to provide the personal data from the date of receiving the request.
If an individual believes personal data held about them is incorrect, they have the right to request for it to be amended.
The right to request that personal data held by an organisation is deleted.
This right allows the individual to request that the organisation does not process their personal data.
Individuals have the right to request their personal data be transferred to another Data Controller.
The individual has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.
The Privacy and Electronic Communications Regulations 2003 (known as PECR) primarily governs marketing by electronic methods such as emails and texts. They set out the conditions under which it is permissible to send electronic marketing directly to individuals. They also apply to the use of Cookies and other tracking technology used by websites.
If you send marketing information by email, text or fax, to a named individual, including a business email, this will be covered by PECR. You will need prior consent from the individual to send them the marketing, unless they have already shown an interest in your products or services and they have been given an opportunity to opt-out of the marketing before they receive it, and on every occasion that the marketing is sent.
You can send direct messages by email or text to your existing customers to ask their opinion on the service they have already received from you. As long as you do not include marketing material, this is not considered to be direct marketing under PECR.
PECR states that consent must be received from the person using the device, before Cookies, or similar tracking devices, such as web-pixels, are placed on the user’s device. This is normally achieved by installing a Cookies options pop-up on your website. If the user rejects the Cookies, they must be switched off during that user’s web-browsing session. For this reason, as an organization, you must identify which Cookies your website is using and list them in your Cookies Notice.
Before making a cold call to an individual, you must check whether they are registered on the Telephone Preference Service (TPS). This is a database, managed by the Information Commissioner, where individuals can register their phone number to be excluded from receiving cold calls for marketing purposes. It is an offence for an organisation to cold call someone registered on the TPS.
The UK GDPR defines consent as:
‘‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her’.
When you are required to get consent under PECR, it must meet this definition. This means you have to ask for ‘opt-in’ consent and the person must also be able to withdraw their consent at any time.
‘A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.’
Part 1 (1), The Freedom of Information (Scotland Act 2002)
FOI(S)A applies to any information held by a Public Authority in Scotland. Anyone, anywhere has the right to ask for such information, and, with some specific exemptions (one of which is personal data), they have the right to receive a copy within 20 working days of receipt of the request.
FOI(S)A also requires Public Authorities to actively publish certain classes of information and make them readily available on their website, or on request. The Scottish Information Commissioner has published a Model Publication Scheme (MPS) which can be adopted by public authorities. The MPS sets out various classes of information which the public authority is expect to publish.
Information about the authority, who we are, where to find us, how to contact us, how we are managed and our external relations.
Information about our work, our strategies and policies for delivering our functions and services and information for our service users.
Information about the decisions we take, how we make decisions and how we involve others.
Information about our strategy for, and management of, financial resources (in sufficient detail to explain how we plan to spend public money and what has actually been spent).
Information about how we manage our human, physical and information resources.
Information about how we procure goods and services and our contracts with external providers.
Information about how we perform as an organisation and how well we deliver our functions and services.
Information packaged and made available for sale on a commercial basis and sold at market value through a retail outlet e.g., bookshop, museum or research journal.
The open data we make available as described by the Scottish Government’s Open Data Strategy and Resource Pack, available under an open licence.
Similar to FOI(S)A, the EIRs are a mechanism for members of the public to access information held by Public Authorities in Scotland. Whereas FOI(S)A applies to any information held by a Public Authority, the EIRs apply to any information held that specifically relates to any information in written, visual, aural, electronic or any other material form, about the environment.
An EIR request must be answered with 20 working days if possible, unless the volume and complexity of the information requested makes it impracticable for the authority either to comply with the request within the earlier period or to make a decision to refuse to do so.
Click the button below to see what is meant by environmental information.
We are a team of expert professionals with considerable experience of data protection / freedom of information, and other related legislation. Feel free to contact us, we are here to help!