The DUA Act amended three key pieces of UK legislation: the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR). 

It is structured across eight Parts and 16 Schedules and introduces changes in several important areas, including:

Scientific research and consent

• Updates the definition of "scientific research" in UK GDPR and simplifies consent requirements for research purposes, aligning the law more closely with existing ICO guidance and Recital 159 of the EU GDPR.

Recognised legitimate interests and lawful bases for processing

• Provides a new lawful basis under Article 6(1)(ea) and provides a non-exhaustive list of recognised legitimate interests, such as public interest tasks, safeguarding, and crime prevention. 

Direct marketing and cookies under PECR

• Expands cookie exemptions (e.g. for statistical or functional purposes), permits the use of soft opt-in for charities, and aligns the maximum PECR fines with those under UK GDPR (up to £17.5 million or 4% of global turnover).

Automated decision-making (ADM)

• Clarifies what constitutes an automated decision under Article 22, introduced the concept of "meaningful human involvement," and limits the use of special category data in fully automated decisions.

Subject access rights and proportionality

• Updates how organisations must respond to subject access requests, allowing them to pause deadlines while waiting for ID or further information, and requiring only a "reasonable and proportionate" search.

International data transfers and adequacy

• Replaces Chapter V of UK GDPR with a new risk-based approach to adequacy decisions and data transfers, giving the Secretary of State discretion to determine whether a third country’s protections are “not materially lower” than the UK’s.

Data protection complaints

• Organisations are legally required to maintain a publicly available documented process for handling data protection complaints, requiring data subjects to complain directly to the controller before escalating concerns to the Information Commissioner.

Marketing and Audience Engagement 

• Higher fines for non-compliance with PECR rules mean that cookie practices and marketing consents need closer attention. 

• Some cookie uses (e.g. for performance or geolocation in emergencies) may no longer require consent, but most other cookies used for advertising or personalisation will still require it. 

• If your business runs mailing lists, promotions, or online ads, review consent processes and cookie banners. 

• The Act confirms that decisions made without meaningful human involvement count as fully automated. This aligns with Article 22 of the UK GDPR, which restricts the use of fully automated decisions that have legal or similarly significant effects on individuals.
• The updated provisions clarify that profiling also counts as automated decision-making when used to make such impactful decisions.
• The concept of “meaningful human involvement” means a real, active role in reviewing the decision, not just passive approval or automated flagging.
• Where decisions involve special category data (e.g. biometric, health, ethnicity), they are only allowed in limited circumstances, such as with explicit consent, where required by law, or where necessary for a contract.

• The Act has introduced a broader definition of “scientific research,” which could benefit businesses conducting audience analysis, archive work, or programme development.
• Consent rules for research are simplified, but transparency, purpose limitation and data minimisation still apply.

• You can pause the response clock when more information or ID is needed from the requester.
• Only a “reasonable and proportionate” search will be required, easing pressure on small businesses.
• The proposal to reject requests as “vexatious” has been dropped, so refusals must still be based on being manifestly unfounded or excessive.

• The Act has introduced a risk-based framework for international data transfers.
• The UK is expected to maintain its EU adequacy decision (allowing EU–UK data flows), but businesses should still review overseas data sharing practices.