Scientific research and the UK’s Data (Use and Access) Act

19 Jun Scientific research and the UK’s Data (Use and Access) Act

Posted at 11:19h in home by

Following extensive parliamentary debate between the upper and lower chambers (particularly around the issue of AI), and having survived a change of government, the UK’s Data (Use and Access) Act (DUAA) has finally passed. Although it received Royal Assent today (19 June 2025) and thus is now formally on the statute books, implementation will be phased over the coming year.

The Act represents some tweaks to the UK’s data protection regime with a view to introducing greater flexibility, which it is hoped will result in economic benefits. It is not intended as a wholesale shake-up of UK GDPR.

Here is a non-exhaustive summary of the key changes we think will affect the scientific research community:

  • ‘Scientific research’ will be more clearly defined, to clarify that it includes both commercial and non-commercial activities. Where studies are in the area of public health, the personal data involved will only fall within the ‘scientific research’ definition if the study is conducted in the public interest.
  • The provisions requiring consent for scientific research will be adapted, the aim being for it to be easier to reuse personal data collected for one piece of research to be used for other scientific research. This flexibility will only apply (i) if, at the time the consent is sought, it is not possible fully to identify the purposes for which the data is to be processed (ii) if the individual is given the option of consenting only to part of the research, and (iii) if generally recognised ethical standards are met.
  • In line with this aim, the DUAA aims to introduce greater flexibility in reusing personal data for different purposes, by listing specific compatible purposes for which data controllers will not be required to carry out a compatibility assessment.
  • Controllers will need to have procedures in place which facilitate complaints brought by individuals about their use of their personal data. The procedure must include a complaints form, which must be responded to within 30 days, and some organisations may have to notify ICO of the number of complaints they receive.
  • The government will have the authority to introduce secondary legislation regarding business data sharing (in a similar vein to the current ‘open banking’ model) in the healthcare sector, as well as in other sectors such as telecoms, insurance and energy.
  • The Information Commissioner’s Office (“ICO”) guidance on dealing with Data Subject Access Requests (“DSARs”) will be embedded into statute, and a new requirement is to be introduced requiring controllers to inform requesters of their reasons if they are seeking to rely on exemptions for legal privilege or confidentiality. Any such explanation can subsequently be challenged by individuals who can refer the scenario to the ICO for review.
  • Article 14 of current UK GDPR regarding the requirement for organisations to supply privacy information (usually done by way of ‘privacy notices’) will no longer apply in instances where providing the information would be “impossible” or where it would “involve disproportionate effort”. This is most likely to apply where controllers have gathered personal data otherwise than directly from the individuals concerned.
  • There will be a relaxation of the current UK GDPR restrictions on the use of automated decision making, to introduce a reduced, more flexible requirement, where controllers must ensure that adequate safeguards are used which allow individuals to challenge decisions and request human review. This paves the way for the increased use of AI in decision-making, but within certain guardrails.

The European Commission is likely to scrutinise the DUAA carefully in its final form, with a view to whether its ‘Adequacy’ decision, which enables easy transfers of data between the UK and EEA Member States, can be upheld. We will be following developments carefully in relation to this decision, which is expected to be announced during December this year.

Please feel free to contact us if you would like further guidance on how these changes may affect your organisation and your research activities or clinical studies, and what you should be doing in order to prepare for these changes.