The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. This pivotal legislation represents the most substantial update to the UK’s data protection framework since GDPR came into effect. The Act can be accessed here.

Legitimate interest

The Bill offers clearer guidance on the use of legitimate interests as a lawful basis. Clause 70 establishes a new category of lawful data processing under the UK GDPR framework – ‘recognised legitimate interests’, these are predefined purposes for which organisations can process personal data without needing to conduct a full legitimate interest assessment.

Effectively, when personal information is used for certain ‘recognised legitimate interests’, it removes the need to balance the impact on the people whose personal information is used, against the benefits arising from that use – for example, when protecting public security.

By codifying this framework, the Bill aims to reduce the compliance burden on organisations, particularly for small and medium-sized enterprises (SMEs). This provision builds on the principles in Recital 47 of the UK GDPR, which already acknowledged fraud prevention as potential legitimate interests.

Research and innovation

A significant win for the market research sector is building on the GDPR’s scientific research provisions. MRS worked extensively with government to ensure curiosity driven research benefits from less burdensome restrictions and that legal provisions provide an innovative environment.

The Act broadens the scope of scientific research to explicitly include commercial activities. This provides confidence for researchers, in enacting research provisions and benefiting from the same legal privileges as academic research. Furthermore, the reforms extend to statistical processing, provided the resulting data is anonymised and not used to make decisions about individuals. These changes deliver greater legal certainty and ease compliance obligations for businesses focused on research, marking a significant step toward boosting innovation and growth in the UK.

One notable aspect of the Act is its support for the responsible reuse of personal data in scientific research and other defined applications, provided specific safeguards are in place and a notice of rights (explaining how the data is being used etc) is published to the website. The Act permits the reuse of personal data for scientific research purposes without requiring privacy notices in cases where providing such notices would be burdensome.

The Act also reinforces the legitimacy of ethical frameworks such as the MRS Code of Conduct, in relation to conditions for consent. This provides confidence to researchers and the public for mechanisms of appropriate and ethical consent under scientific research provisions, specific to the research sector.

Finally, the Act introduces changes to cookie rules, specifically allowing for the use of certain cookies for statistical purposes without requiring explicit consent. This means organisations can collect data to improve services and websites without needing to obtain user consent for these specific cookie uses. 

EU data adequacy

The Act has been carefully structured to ensure alignment with fundamental EU data protection principles and rulings from the European Court of Justice. This alignment is crucial for maintaining the UK’s adequacy status, which facilitates the seamless transfer of personal data from the EU to the UK.  

MRS has regularly highlighted the need for the UK to maintain its data adequacy, including responding to the House of Lords inquiry on this issue. The loss of adequacy recognition remains a significant risk associated with UK data reform. However, by adopting a legally clear and proportionate approach, the government has taken steps to safeguard the competitiveness of UK organisations in global markets and the UK government expects adequacy to be retained when it is reviewed at the end of 2025.

Striking a balance

The Data (Use and Access) Act marks a transformative moment in the UK’s data governance landscape and success for the research sector. The Act clarifies the use of legitimate interests, expanding the scope for research and innovation, and should preserve EU data adequacy.

The legislation strikes a balance between regulatory clarity and operational flexibility. For the research sector it offers a more enabling environment to harness data responsibly while maintaining public trust and international alignment. It also provides confidence to the sector to implement scientific research provisions, therefore enabling and engaging in an environment that fosters creativity and curiosity, while ensuring adherence to ethical and appropriate practices.

Many of the Act’s provisions will be enabled through secondary legislation and incremental updates rather than an overnight change.  Some of the changes, such as those to cookies etc, are expected to come in quickly. As implementation unfolds, continued engagement with ethical standards and sector-specific guidance, established in the MRS Code of Conduct, will be key to realising the full benefits of this pivotal reform.

Kaleke Kolawole is policy manager at MRS

• Find out more about the MRS Code of Conduct here.