Privacy & Information Security Law Blog

On June 19, 2025, the UK Data (Use and Access) Act 2025 (the “DUAA”) received Royal Assent. The same day, the UK Information Commissioner’s Office (the “ICO”) published a comprehensive suite of resources on the DUAA. The resources include, among other things, a factual summary of the DUAA and an outline of the ICO’s plans to roll out new or updated guidance as the DUAA’s provisions gradually come into effect. The implementation of these provisions will be staggered, with some likely taking up to 12 months.

In line with the amendments introduced by the DUAA, the UK government also announced a recruiting campaign for seven non-executive members to the board of the new Information Commission which will be established by the DUAA. This new body will succeed the ICO as the UK’s data protection regulator.

For further information on the provisions introduced by the DUAA, read our previous article.