The Data Use and Access Act (DUAA) 2025 marks a major shift in how organisations across the UK must manage, access, share, and protect data. Designed to modernise digital governance and strengthen accountability, DUAA 2025 introduces new rules that affect businesses of all sizes — from micro‑enterprises to large corporations and public bodies.
If your organisation processes data, uses digital systems, relies on automation, or shares information with third parties, DUAA 2025 applies to you. Below is a clear breakdown of what the Act means in practice and how organisations must prepare.
Stronger Rules on Data Access and Internal Permissions
DUAA 2025 requires organisations to implement stricter access controls for all data — not just personal data.
This means:
- Access must be based on least privilege
- Organisations must maintain clear access logs
- Regular access reviews are mandatory
- Staff must only access data necessary for their role
- Shared drives and cloud platforms must be properly segmented
This aligns closely with UK GDPR but expands the requirement to all organisational data, including operational, commercial, and administrative information.
Mandatory Data Use Governance Frameworks
Under DUAA 2025, organisations must establish a Data Use Governance Framework that outlines:
- How data is used
- Who can use it
- Why it is used
- How decisions about data use are made
- How risks are assessed and mitigated
This framework must be documented, reviewed regularly, and available for regulatory inspection.
For organisations already following GDPR accountability principles, this is a natural extension — but it requires broader governance beyond personal data.
Clear Justification for All Data Use
DUAA 2025 introduces a new requirement: every use of data must be justified, documented, and proportionate.
This includes:
- Operational data
- Analytical data
- AI training data
- Customer data
- Supplier data
- Employee data
Organisations must be able to demonstrate:
- Why the data is needed
- How it benefits the organisation or individual
- That no excessive data is being used
- That risks have been assessed
This significantly strengthens the principle of data minimisation.
New Obligations for Data Sharing and Third‑Party Access
DUAA 2025 tightens rules around data sharing, requiring organisations to:
- Document all data‑sharing arrangements
- Conduct risk assessments before sharing data
- Ensure third parties meet DUAA and GDPR standards
- Maintain clear records of what data was shared, when, and why
- Provide transparency to individuals where personal data is involved
This affects:
- Vendors
- Cloud providers
- Consultants
- Outsourced services
- Partner organisations
Data sharing without proper governance is now a regulatory risk.
Stricter Controls on Automated Access and AI Systems
DUAA 2025 introduces new rules for automated systems that access or use data, including:
- AI tools
- Machine learning models
- Automated decision‑making systems
- Behavioural analytics
- Digital platforms
Organisations must ensure:
- Automated access is justified
- Systems are tested for fairness and accuracy
- Bias risks are assessed
- Outputs are explainable
- Human oversight is available
- Automated access is logged and monitored
This aligns with UK GDPR’s rules on automated decision‑making but expands them to all data, not just personal data.
Mandatory Data Access Risk Assessments (DARAs)
DUAA 2025 introduces Data Access Risk Assessments (DARAs) — similar to DPIAs but focused on access and use rather than processing.
DARAs are required when:
- Data is accessed by automated systems
- Large volumes of data are used
- Sensitive or high‑risk data is involved
- Data is shared externally
- New digital tools are introduced
- Access affects vulnerable individuals
DARAs must identify:
- Access risks
- Misuse risks
- Security vulnerabilities
- Governance gaps
- Mitigation measures
Organisations must maintain DARA documentation and update it regularly.
Enhanced Security Requirements for All Data
DUAA 2025 strengthens expectations around data security, requiring organisations to implement:
- Encryption
- Multi‑factor authentication
- Role‑based access controls
- Secure storage
- Monitoring and audit trails
- Regular security testing
- Incident response plans
This applies to all data, not just personal data — making DUAA broader than GDPR.
Transparency Requirements for Data Use
Organisations must now provide clear, accessible information about:
- How data is used
- Why data is accessed
- Who has access
- How decisions about data use are made
- How individuals can challenge data use (where personal data is involved)
Transparency is no longer limited to privacy notices — it applies to all data‑driven operations.
Increased Regulatory Oversight and Penalties
DUAA 2025 gives regulators expanded powers to investigate data use practices and issue penalties for non‑compliance.
Penalties can be issued for:
- Unjustified data use
- Excessive access permissions
- Poor governance
- Inadequate security controls
- Failure to conduct DARAs
- Misuse of automated systems
- Lack of transparency
Fines can reach millions, similar to UK GDPR enforcement levels.
Why Paying for Data Protection and Governance Services Is Always Cheaper Than DUAA Penalties
DUAA 2025 significantly increases the compliance burden for organisations using digital tools, automation, or large datasets. But the cost of proactive compliance is far lower than the cost of enforcement.
Professional support helps organisations:
- Avoid regulatory penalties
- Strengthen governance
- Ensure lawful and justified data use
- Conduct compliant DARAs
- Improve transparency
- Secure digital systems
- Align DUAA requirements with existing GDPR practices
Proactive compliance is always cheaper — and far safer — than reactive enforcement.
Conclusion
The Data Use and Access Act 2025 represents a major evolution in UK digital governance. It strengthens accountability, regulates data access, expands transparency requirements, and introduces new obligations for automated systems and data sharing.
For organisations already committed to GDPR compliance, DUAA is a natural extension — but it still requires updated documentation, stronger governance, and careful planning.
By understanding DUAA 2025 and implementing robust data use controls, organisations can operate confidently, securely, and transparently in an increasingly data‑driven world.
