Data (Use and Access) Act 2025
The Data (Use and Access) Act 2025 amends and supplements the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003. It introduces new rules on data sharing, access, and use, aiming to facilitate responsible data use while maintaining strong privacy protections.
Data (Use and Access) Act 2025 is a compliance framework from United Kingdom with 7 domains and 18 controls that map to 2 other frameworks. The largest domains are DUAA 2025: Part 5 - Data Protection and Privacy Reforms (8 controls), DUAA 2025: Part 1 - Access to Customer and Business Data (Smart Data) (3 controls), DUAA 2025: Part 2 - Digital Verification Services (3 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (7)
DUAA 2025: Part 1 - Access to Customer and Business Data (Smart Data)
| Code | Title |
|---|---|
| DUAA-P1-AUTH | Authorised persons and accreditation under smart data schemes |
| DUAA-P1-FEESENF | Fees, levies and enforcement of smart data schemes |
| DUAA-P1-SMARTDATA | Smart data schemes for customer and business data |
DUAA 2025: Part 2 - Digital Verification Services
| Code | Title |
|---|---|
| DUAA-P2-DVS | Digital verification services and the DVS trust framework |
| DUAA-P2-GATEWAY | Information gateway for identity verification |
| DUAA-P2-TRUSTMARK | DVS trust mark usage |
DUAA 2025: Part 3 - National Underground Asset Register
| Code | Title |
|---|---|
| DUAA-P3-NUAR | National Underground Asset Register |
DUAA 2025: Part 4 - Registers of Births and Deaths
| Code | Title |
|---|---|
| DUAA-P4-REGISTERS | Digitisation of registers of births and deaths |
DUAA 2025: Part 5 - Data Protection and Privacy Reforms
| Code | Title |
|---|---|
| DUAA-P5-ADM | Automated decision-making reforms |
| DUAA-P5-CHILDREN | Children's data protection by design (ISS) |
| DUAA-P5-COMPLAINTS | Complaints to data controllers |
| DUAA-P5-DSR | Data subject access requests (reasonable and proportionate searches) |
| DUAA-P5-LAWFUL | Lawful processing and recognised legitimate interests |
| DUAA-P5-PECR | PECR reforms (cookies, direct marketing, penalties) |
| DUAA-P5-RESEARCH | Research, statistics and archiving processing |
| DUAA-P5-TRANSFERS | International transfers data protection test |
DUAA 2025: Part 6 - The Information Commission
| Code | Title |
|---|---|
| DUAA-P6-INFOCOMM | The Information Commission |
DUAA 2025: Part 7 - Other Provision (Health Information Standards)
| Code | Title |
|---|---|
| DUAA-P7-HEALTH | Information standards for health and adult social care |
Maps to 2 other frameworks
What is Data (Use and Access) Act 2025 and who does it apply to?
Data (Use and Access) Act 2025 is a compliance framework from United Kingdom with 7 domains and 18 controls. The Data (Use and Access) Act 2025 amends and supplements the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003. It introduces new rules on data sharing, access, and use, aiming to facilitate responsible data use while maintaining strong privacy protections. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Data (Use and Access) Act 2025 actually require?
Data (Use and Access) Act 2025 has 18 controls organised across 7 domains. The largest domains are DUAA 2025: Part 5 - Data Protection and Privacy Reforms (8 controls), DUAA 2025: Part 1 - Access to Customer and Business Data (Smart Data) (3 controls), DUAA 2025: Part 2 - Digital Verification Services (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Data (Use and Access) Act 2025 do I already cover?
Data (Use and Access) Act 2025 maps to 2 other compliance frameworks. The top mapping partners are GDPR (22% coverage), ISO 27701:2019 (6% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement Data (Use and Access) Act 2025?
Start your Data (Use and Access) Act 2025 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Data (Use and Access) Act 2025 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 18 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.
Get Started Free →Free forever — no credit card required