The Data (Use and Access) Act 2025 ("DUAA") is the UK's principal data-protection reform of the current Parliament, receiving Royal Assent on 19 June 2025 as Chapter 18 of the 2025 Acts (2025 c. 18). Enacted by the UK Parliament and led by the Department for Science, Innovation and Technology (DSIT), it is not AI-specific legislation, but several of its provisions directly affect AI deployment.
Royal Assent: 19 June 2025 Chapter: 2025 c. 18 Enacting body: UK Parliament Responsible department: Department for Science, Innovation and Technology (DSIT)
Overview
DUAA replaces the failed Data Protection and Digital Information Bill (DPDI) of the previous Conservative government with a narrower Labour package framed as "pro-growth" data reform. The Act amends UK GDPR and the Data Protection Act 2018. DSIT estimates up to GBP 10 billion in gains over a decade from smart-data schemes, digital verification services, and clearer public-sector data-sharing rules; this is a self-reported government figure with limited independent verification.
Provisions relevant to AI
Automated decision-making
The Act replaces UK GDPR Article 22's narrow prohibition on "solely automated" decisions with a framework centred on "significant decisions". Solely automated significant decisions are permitted subject to safeguards: notice to the data subject, a right to human intervention, a right to make representations, and a right to contest. Special-category data retains the stricter Article 22-style regime. DSIT frames this as clarity for AI-assisted decision systems; civil-society critics including the Ada Lovelace Institute and the Open Rights Group characterise it as loosening an AI accountability safeguard. (Source: this source)
ICO becomes the Information Commission
The Information Commissioner's Office is reconstituted as a corporate Information Commission with a board structure and new enforcement powers. The Commission gains a statutory duty to have regard to innovation, public safety, and children's interests. The addition of the innovation duty drew opposition, with critics arguing it could weaken the regulator's independence on AI matters. (Source: this source)
Recognised legitimate interests
The Act creates a new lawful basis, "recognised legitimate interests," for specified processing without a balancing test: national security, emergency response, safeguarding, and crime prevention. AI model training is not on this list. An attempt to add a text-and-data-mining exception for AI training was withdrawn after Lords opposition.
Scientific research clarification
"Scientific research" in UK GDPR is confirmed to include commercial research, and broad consent for "an area of research" is permitted. Commentary notes this could reduce friction for some AI-training pipelines framed as research, though it is not a standalone AI-training exemption.
Copyright and AI training — deferred
Baroness Kidron's amendments requiring disclosure of copyrighted training data and rightsholder opt-out mechanisms were defeated after a prolonged Lords-Commons standoff. The government committed to a separate consultation and a report to Parliament within 9 months of Royal Assent. As of April 2026 that report was still pending. (Source: this source)
Provisions absent from the Act
DUAA does not establish a general algorithmic-accountability regime, does not mandate algorithmic impact assessments, does not create a public-sector algorithm register, does not impose foundation-model transparency rules, and does not create an AI-specific regulator.
Key claims (with confidence)
- High confidence: DUAA received Royal Assent 19 June 2025 as Chapter 18 of the 2025 Acts.
- High confidence: DUAA reforms Article 22 automated-decision-making rules, permitting solely-automated significant decisions subject to safeguards.
- High confidence: DUAA reconstitutes the ICO as the Information Commission and gives it a statutory innovation duty.
- High confidence: AI-and-copyright questions were deferred; the Kidron amendments were defeated; the consultation outcome is pending.
- Medium confidence: DSIT's GBP 10 billion economic-benefit estimate (self-reported government figure; independent verification limited).
- High confidence: DUAA is not AI-specific legislation. AI-specific regulation is deferred to the promised and delayed AI Bill — see UK AI Bill — Status and Delay (Source Summary).
Context
DUAA is the first UK statute with material AI-relevant provisions, providing partial, data-protection-only coverage of AI while AI-specific rules remain deferred. It contrasts with EU AI Act (Regulation 2024/1689)'s comprehensive risk-tier framework and with US state activity (California SB 53 — Transparency in Frontier AI Act, Texas Responsible AI Governance Act (TRAIGA / HB 149) — Source Summary, Colorado AI Act (SB 24-205) and SB 25B-004 (Date Amendment)). The Act does not alter the operating context of the UK AI Safety Institute (AI Security Institute), which continues to operate on voluntary pre-deployment access because no statute compels it.
No other pages contradict DUAA's provisions.
Relationships
- supports: UK Data (Use and Access) Act 2025 (legislation page)
- related: UK AI Bill — Status and Delay (Source Summary) — the separate, delayed AI-specific bill
- related: UK AI Safety Institute (AI Security Institute) — operates in the voluntary environment DUAA does not change
- related: EU AI Act (Regulation 2024/1689) — comparator (comprehensive) and adequacy-decision context
- related: EU General-Purpose AI Code of Practice (Final Version, 2025) — contrast with EU's GPAI regime
- related: AI Copyright Litigation — Analysis — copyright-training question DUAA deferred
Privacy
No PII, credentials, or sensitive identifiers present in the source material.
Provenance
- Full text:
https://www.legislation.gov.uk/ukpga/2025/18/contents - Parliamentary record:
https://bills.parliament.uk/bills/3825 - Raw compilation: (Source: Raw Sources/UK Data Use and Access Act 2025.md)