UK organisations to benefit from new data protection laws

The Data (Use and Access) Act 2025 (DUAA) is new legislation that updates key aspects of data protection law, though it does not replace the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR). These changes are designed to make data protection law clearer and more flexible for organisations, while maintaining strong safeguards for individuals. 

Changes to the law include: clarifying how personal information can be used for research; lifting restrictions on some automated decision making; setting out how to use some cookies without consent; allowing charities to send people electronic mail marketing without consent in certain circumstances; requiring organisations to have a data protection complaints procedure and introducing a new lawful basis of recognised legitimate interests.   

The Act provides the ICO with new powers, including the ability to compel witnesses to attend interviews, request technical reports, and issue fines of up to £17.5 million or 4% of global turnover under PECR. 

• We have lots of DUAA guidance and resources to support you and your business 
• Check what new guidance is in the pipeline 
• Let us know what you think of our guidance by taking our short survey 
• Get the latest DUAA updates direct to your inbox by subscribing to our dedicated newsletter

You've never been to DPPC?

It's great! DPPC is our annual data protection practitioners' conference. Last year 82% of delegates said they learned something new. Whether you are a beginner or specialist, or data protection is only part of your job, DPPC has something for everyone.
 
We will cover the things that are important to you - topics such as AI, cyber security and the DUAA changes Paul talked about in his introduction.

It's free, and there are no transport or overnight costs because it's all online. Register your place today for the conference on 14 October 2025. You're guaranteed a warm welcome.

Eight men guilty following our largest ever nuisance-call investigation.

What happened? From one initial complaint to us, our investigation snowballed into one of the largest nuisance-call cases we have ever dealt with. After identifying the eight men involved, our investigations team conducted nine warrants in the Manchester and Macclesfield areas. The devices seized under search warrant contained 241,000 emails, 4.5 million documents, 144,000 spreadsheets, 1.5 million images and 83,000 multimedia files.

The impact on you The defendants were found to have conspired together between 2014 and 2017, where they accessed or obtained personal data of people from vehicle repair garages without their consent. Approximately one million records were accessed by the defendants convicted of an offence under the Computer Misuse Act. This data was then sold onto claims management firms hoping to generate potential leads for personal injury claims.

We are continuing our investigations and anticipate further prosecutions of people embedded into insurance companies and claims management companies with the sole aim of stealing personal data.