The long-awaited reform of the UK General Data Protection Regulation received Royal Assent on 19 June 2025. The Data (Use and Access) Act 2025 was the government's third attempt at GDPR reform (after two previous failed incarnations of the Data Protection and Digital Information Bill proposed by the conservative government).
Whilst it is fair to say that the Act does not represent a wholesale reform of the UK GDPR and is perhaps more akin to tweaks around the edges, there are nonetheless some changes which organisations should be aware of, including in relation to:
- automated decision making (significant in the context of ever-increasing use of AI);
- subject access requests; and
- international data transfers.
For more information see our Data Notes blog post here.
Disclaimer
The articles published on this website, current at the dates of publication set out above, are for reference purposes only. They do not constitute legal advice and should not be relied upon as such. Specific legal advice about your specific circumstances should always be sought separately before taking any action.