London, UK – The Data (Use and Access) (DUA) Bill has successfully navigated both Houses of Parliament and now stands on the precipice of becoming law, awaiting Royal Assent. The Bill was passed on 11 June 2025, signalling a potential evolution in the UK's post-Brexit data protection landscape.
For small business owners, freelancers, digital marketers, and website operators, the Data (Use and Access) Bill represents the government's continued commitment to forging an independent data protection regime distinct from the EU GDPR.
A New Chapter for International Data Transfers
One of the most keenly anticipated areas of change is the framework for international data transfers. The Act could streamline the process for assessing destination countries with a more risk-based approach to 'adequacy'. It is expected to clarify and potentially expand the use of alternative transfer mechanisms including revised Standard Contractual Clauses (SCCs).
New Requirements for UK Organisations
- Refined Accountability Frameworks: Clearer guidance with more proportionate measures for demonstrating accountability, especially for SMEs
- Streamlined ICO Powers: Clarified powers with enhanced ability to issue guidance and promote compliance
- Emphasis on Risk-Based Approach: Focus resources on greatest data protection risks rather than tick-box exercises
- Clarity on Data Subject Rights: Possible clarifications on exercise of rights or response procedures
Impact on Your UK Business
- Review Your Data Flows: Understand where your data is stored and processed, especially if it leaves the UK
- Update Policies and Notices: Be prepared to update privacy notices and internal policies
- Stay Informed on ICO Guidance: Watch for updated guidance following the Act's enactment
- Maintain Accountability: Continue documenting data processing activities and conducting DPIAs
UK GDPR Jurisdiction: A Clear Distinction
The Data (Use and Access) Act is UK law, marking further divergence from the EU GDPR. It highlights the UK's ability to set its own standards while maintaining high levels of data protection. Staying informed will be your best defence against non-compliance and your key to leveraging any new flexibilities the Act may introduce.