DUAA : Data (Use and Access) Act 2025 amends, but does not replace, the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA) and the Privacy and Electronic Communications Regulations (PECR). It marks the first significant divergence of UK data protection law from the EU GDPR.
The DUAA received royal assent on June 19, 2025. It will be rolled out in stages, with most provisions set to take effect within two to six months, although certain measures could require up to a year to be fully implemented.