The UK’s data revolution is here: what the new Data (Use and Access) Bill (DUAB) means for your business.

After months of parliamentary wrangling, dominated by debates on AI and copyright, the Data (Use and Access) Bill (DUAB) has finally cleared its path through Westminster. It’s easy to get lost in the legal weeds, but here’s the reality: this is one of the most important digital reforms in a decade. And if you run a business, lead a legal team, work in tech, or deal with data (so, nearly everyone), you need to know what’s coming.

Here’s why DUAB is a big deal and what it could mean for you:

1. CRACKING DOWN ON COOKIE CHAOS.
The DUAB strengthens enforcement of cookie and direct electronic marketing rules by aligning the Privacy and Electronic Communications Regulations (PECR) penalties with UK GDPR (up to £17.5m or 4% of global turnover). This gives the ICO greater power to act on non-compliant cookie banners, tracking tech, and unsolicited marketing.  It also extends the “soft opt-in” for marketing emails to charities, not just commercial organisations, and confirms that direct marketing can be a legitimate interest under UK GDPR.  Other key updates include, clearer exceptions for essential cookies, analytics, and emergency use and extended breach reporting timeframes for telecoms firms, from 24 to 72 hours.

What does this mean for business?
You can:

• Justify email marketing without explicit opt-in—if it’s relevant, not intrusive, and opt-outs are easy.
• Simplify marketing for repeat customers or newsletter sign-ups.
• Still use cookies or trackers for analytics, security, or functionality without consent (within reason).

But you must:

• Audit your cookie banners and marketing lists.
• Review your PECR and marketing compliance policies.
• Prepare for tougher ICO scrutiny on tracking tech (beacons, fingerprinting, etc.)

2. DSAR RELIEF AND CLARITY (FINALLY).
Dealing with Data Subject Access Requests (DSARs) can be painful. DUAB introduces a ‘stop the clock’ rule for verifying identity and clarifies that searches only need to be reasonable and proportionate (but without saying what that means in practice). The change is to be treated as having come into force on 1 January 2024.

What does this mean for business?
If you’re an HR team handling ex-employee DSARs or a customer service team processing complex requests, this is a win. You’ll save time, reduce the need for exhaustive searches, and cut the risk of falling foul of tight response deadlines. But be prepared to justify the extent of your searches.

3. FROM OPEN BANKING TO OPEN EVERYTHING.

The DUAB builds on the UK’s open banking success, extending customer data sharing into finance, pensions, insurance, and beyond, and giving the government scope to expand this to sectors like energy and telecoms. It’s all about enabling competition and innovation through safe, customer-consented data sharing. Expect the Fintech revolution to evolve into other sectors.

What does this mean for business?
New entrants can build tailored services, like pension comparison tools, green energy switching apps, or small business financial dashboards—without having to build the data infrastructure themselves. You’ll be able to integrate with trusted intermediaries to access verified customer data securely.

4. AUTOMATED DECISIONS-WITH HUMAN OVERSIGHT.
The DUAB opens the door for broader use of AI in decision-making, so long as proper safeguards are in place. Individuals must still be able to challenge outcomes and request human review, especially where decisions impact them significantly or involve sensitive data.

What does this mean for business?
If you’re using automation for things like credit scoring, job screening, or customer support triage, you’ll need to implement internal review processes and ensure your teams can explain AI-driven outcomes. Think audit trails, human override functions, and clear communication with users.

5. EASIER, MORE FLEXIBLE RESEARCH.
The DUAB introduces “flexible consent”, meaning researchers don’t have to go back to participants every time a study changes direction, provided the use remains genuinely scientific.

What does this mean for business?
If you’re in life sciences, edtech, medtech, or even customer insights, you can adapt your projects as they evolve without restarting the consent process. For example, if you’re a health startup analysing anonymised patient data, you can expand your study without a legal headache.

6. CLEARER, DIGITAL VERIFICATION.
The DUAB sets out a new framework for digital ID verification services, clearing up uncertainty over how third parties can verify someone’s identity or claims, such as employment history or qualifications.

What does this mean for business?
If you’re onboarding staff, verifying customers, or conducting background checks, this creates a clearer legal pathway. Whether you’re in HR tech, FinTech, legal, or recruitment, expect smoother onboarding and better trust in third-party verification tools.

7. GOODBYE, SURPRISE ROADWORKS?
The DUAB introduces a National Underground Asset Register (NUAR) across England, Wales, and Northern Ireland, mapping underground infrastructure to avoid disruption during street works.  It’s a quiet revolution in infrastructure, with real-world impact.

What does this mean for business?
If you’re in utilities, construction, local government or infrastructure, you’ll likely need to input and maintain asset data in the register. This could improve project planning, reduce delays, and prevent costly damage to underground assets.  Details on data requirements and access will follow in future regulations.

TIMELINES AND WHAT’S NEXT.

• DUAB is expected to receive Royal Assent soon and become law.
• Most changes need further regulations before they take effect.
• The government’s next “common commencement date” is 1 October 2025, but some parts may go live sooner.
• The EU is watching closely. If the UK drifts too far from GDPR, the UK’s adequacy status (and smooth EU-UK data flows) could be at risk.

BRAVE Thoughts.

The DUAB is a quiet but powerful rebalancing act, boosting innovation while protecting privacy. For startups, researchers, utilities, marketers, and AI developers, it’s both an opportunity and a wake-up call.

Now’s the time to review your data practices, assess your risk exposure, and plan for what’s next.