The new rules on data protection have effectively clarified the various Acts controlling data storage and use, improving the law so ‘it is structured to make it easier to follow, but without materially changing how you can use personal information’, the Information Commissioner’s Office (ICO) said.

The Data (Use and Access) Act 2025 (DUAA) has received Royal Assent, updating key aspects of data protection law. The DUAA amends, but does not replace the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA) and the Privacy and Electronic Communications Regulations (PECR).