--- title: "Data Use and Access Act 2025: What UK Data Governance Professionals Need to Know" description: A practical summary of the Data (Use and Access) Act 2025 (DUAA) and what UK data professionals must do now to manage risk, AI governance and compliance. image: https://metadataworks.ai/hubfs/AI-Generated%20Media/Images/The%20image%20depicts%20a%20modern%20welllit%20office%20environment%20filled%20with%20professionals%20engaged%20in%20discussions%20around%20data%20governance%20A%20large%20whiteboard%20is%20vi-1.png --- [Skip to content](https://metadataworks.ai/blog/data-use-and-access-act-2025-what-uk-data-governance-professionals-need-to-know#main-content) [![](https://metadataworks.ai/hubfs/header-logo.svg)](https://metadataworks.ai/) - [About Us](https://metadataworks.ai/about-us) - [Our Solution](https://metadataworks.ai/solutions) - [Our Clients](https://metadataworks.ai/case-studies) - [Contact](https://metadataworks.ai/contact) - [Insights](https://metadataworks.ai/insights) Open main navigation Close main navigation - [About Us](https://metadataworks.ai/about-us) - [Our Solution](https://metadataworks.ai/solutions) - [Our Clients](https://metadataworks.ai/case-studies) - [Contact](https://metadataworks.ai/contact) - [Insights](https://metadataworks.ai/insights) - [Book a Demo](https://metadataworks.ai/demo) [Book a Demo](https://metadataworks.ai/demo) [All posts](https://metadataworks.ai/blog/all) February 12, 2026 # Data Use and Access Act 2025: What UK Data Governance Professionals Need to Know ![Picture of Adam](https://metadataworks.ai/hs-fs/hubfs/adam.jpeg?width=50&name=adam.jpeg) By  [Adam](https://metadataworks.ai/blog/author/adam)  ·  2 minute read Earlier this month, most of the data protection provisions under the **Data (Use and Access) Act 2025 (DUAA)** came into force. This has pragmatic implications for many of our clients and contacts in the data industry - the changes materially affect enforcement risk, lawful basis decisions, AI governance, and operational compliance processes. The Act updates the **UK GDPR**, the **Data Protection Act 2018**, and **PECR**, marking the most significant shift in the UK data protection landscape since Brexit. Below is a concise summary of what matters most to UK data professionals and some very brief notes on the kinds of action you and your teams should consider implementing. **“Recognised Legitimate Interests”** The Act introduces a new category of lawful basis called **recognised legitimate interests**. A *lawful basis* is the legal justification for processing personal data. Normally, using “legitimate interests” requires a documented balancing test between organisational need and individual rights. Under DUAA, certain defined activities (such as safeguarding or crime prevention) may rely on recognised legitimate interests **without performing that balancing test each time.** **What to do:** **DSAR Clarifications** A **Data Subject Access Request (DSAR)** allows individuals to ask what personal data you hold about them. DUAA clarifies expectations around: This offers practical flexibility but still requires careful documentation. **What to do:** **Automated Decision-Making (ADM) and AI** **Automated decision-making (ADM)** refers to decisions made by systems with little or no human involvement (e.g. credit scoring, AI screening tools). DUAA broadens when ADM may be permitted under certain lawful bases but maintains requirements for: **What to do:** **Complaints Procedures (From June 2026)** From **June 2026**, organisations must implement a formal internal **data protection complaints procedure**. **Prepare now by:** **Increased Enforcement Risk (Especially Under PECR)** Perhaps less of a pragmatic concern for many of our public sector clients at MetadataWorks, but worth noting all the same. PECR — which governs electronic marketing, cookies, and communications privacy — now carries fines aligned with UK GDPR levels: This significantly increases exposure for non-compliant marketing practices, cookie implementations, and consent mechanisms. **What to do:** **Need Help?** If your organisation would like support understanding what these changes mean in practice my door is always open. You can contact us at [**hello@metadataworks.co.uk**](mailto:hello@metadataworks.co.uk)**–** we’ll make sure your organisation keeps up with the legislative changes. Share: [facebook-f icon](http://www.facebook.com/share.php?u=https://metadataworks.ai/blog/data-use-and-access-act-2025-what-uk-data-governance-professionals-need-to-know) [linkedin-in icon](http://www.linkedin.com/shareArticle?mini=true&url=https://metadataworks.ai/blog/data-use-and-access-act-2025-what-uk-data-governance-professionals-need-to-know) [twitter icon](https://twitter.com/intent/tweet?url=https://metadataworks.ai/blog/data-use-and-access-act-2025-what-uk-data-governance-professionals-need-to-know) [pinterest-p icon](http://pinterest.com/pin/create/link/?url=https://metadataworks.ai/blog/data-use-and-access-act-2025-what-uk-data-governance-professionals-need-to-know) [envelope icon](mailto:?body=https://metadataworks.ai/blog/data-use-and-access-act-2025-what-uk-data-governance-professionals-need-to-know) ## Related posts [![](https://metadataworks.ai/hubfs/grin-H4y6aOmgkMU-unsplash.jpg)](https://metadataworks.ai/blog/upcoming-webinar-creating-improved-access-to-research-data-through-a-user-centric-data-catalogue) [News](https://metadataworks.ai/blog/tag/news) ### [Upcoming Webinar: Creating Improved Access to Research Data Through A User Centric Data Catalogue](https://metadataworks.ai/blog/upcoming-webinar-creating-improved-access-to-research-data-through-a-user-centric-data-catalogue) [![KMS Case Study](https://metadataworks.ai/hubfs/optimized_doctor_computer.jpeg)](https://metadataworks.ai/blog/establishing-a-cohesive-library-improving-the-user-journey-of-a-secure-data-environment) [Thoughts](https://metadataworks.ai/blog/tag/thoughts) ### [Establishing a cohesive library: improving the user journey of a Secure Data Environment](https://metadataworks.ai/blog/establishing-a-cohesive-library-improving-the-user-journey-of-a-secure-data-environment) [![](https://metadataworks.ai/hubfs/blog1.jpg)](https://metadataworks.ai/blog/navigating-the-complexities-of-data-access-in-healthcare-balancing-risk-and-opportunity) ### [Navigating the Complexities of Data Access in Healthcare: Balancing Risk and Opportunity](https://metadataworks.ai/blog/navigating-the-complexities-of-data-access-in-healthcare-balancing-risk-and-opportunity) [![header-logo](https://metadataworks.ai/hubfs/header-logo.svg)](https://metadataworks.ai/home) Amplify data impact [![linkedin-round-icon](https://metadataworks.ai/hs-fs/hubfs/linkedin-round-icon-2048x2048-jufaif8u.png?width=40&height=40&name=linkedin-round-icon-2048x2048-jufaif8u.png)](https://www.linkedin.com/company/35531176/admin/dashboard/)[![x-twitter-logo-on-black-circle-5694247](https://metadataworks.ai/hs-fs/hubfs/x-twitter-logo-on-black-circle-5694247.png?width=40&height=40&name=x-twitter-logo-on-black-circle-5694247.png)](https://x.com/MetadataW)   **COMPANY**   [Home](https://metadataworks.ai/home) [Contact](https://metadataworks.ai/contact) [Careers](mailto:hello@metadataworks.co.uk) **PLATFORM** [Solutions](https://metadataworks.ai/solutions) [Case Studies](https://metadataworks.ai/case-studies) [Demo](mailto:hello@metadataworks.co.uk) **LEGAL** [Privacy Policy](https://metadataworks.ai/privacy-policy) [Accessibility Statement](https://metadataworks.ai/accessibility-statement) [Cookies](https://metadataworks.ai/cookies) Copyright © 2026, Metadataworks ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Adam", "url" : "https://metadataworks.ai/blog/author/adam" }, "dateModified" : "2026-02-12T12:36:32.719Z", "datePublished" : "2026-02-12T12:33:23.000Z", "headline" : "Data Use and Access Act 2025: What UK Data Governance Professionals Need to Know", "image" : [ "https://metadataworks.ai/hubfs/AI-Generated%20Media/Images/The%20image%20depicts%20a%20modern%20welllit%20office%20environment%20filled%20with%20professionals%20engaged%20in%20discussions%20around%20data%20governance%20A%20large%20whiteboard%20is%20vi-1.png" ], "mainEntityOfPage" : { "@id" : "https://metadataworks.ai/blog/data-use-and-access-act-2025-what-uk-data-governance-professionals-need-to-know", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://metadataworks.ai/hubfs/header-logo.svg" } } } ``` ```json { "@context" : "http://schema.org", "@type" : "Article", "author" : { "@type" : "Person", "name" : [ "Adam" ], "url" : "https://metadataworks.ai/blog/author/adam" }, "datePublished" : "2026-02-12T12:33:23+0000", "description" : "A practical summary of the Data (Use and Access) Act 2025 (DUAA) and what UK data professionals must do now to manage risk, AI governance and compliance.", "headline" : "Data Use and Access Act 2025: What UK Data Governance Professionals Need to Know", "image" : "https://25578497.fs1.hubspotusercontent-eu1.net/hubfs/25578497/AI-Generated%20Media/Images/The%20image%20depicts%20a%20modern%20welllit%20office%20environment%20filled%20with%20professionals%20engaged%20in%20discussions%20around%20data%20governance%20A%20large%20whiteboard%20is%20vi-1.png", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://25578497.fs1.hubspotusercontent-eu1.net/hubfs/25578497/header-logo.svg" }, "name" : "Metadataworks" }, "url" : "https://metadataworks.ai/blog/data-use-and-access-act-2025-what-uk-data-governance-professionals-need-to-know" } ```