The Data (Use & Access) Act 2025 might already be on the Statute Book but the Law Society of England & Wales has claimed there are still major issues to iron out, despite the Information Commissioner’s Office confirming UK firms will have less than 12 months to implement the changes.
While industry trade body the DMA and privacy organisation Open Rights Group appear to be at loggerheads over the legislation, with the former claiming it will boost business and the latter insisting it will erode data rights, the Law Society is adamant that adequate checks and balances must exist to ensure privacy protections, particularly concerning personal data.
In addition, the organisation has called for more clarity on how AI and tech companies can use copyrighted content without permission, a major bone of contention with the House of Lords and one which the Government has insisted will be covered by separate legislation.
Law Society chief executive Ian Jeffery said: “The new Act affects the legal sector by updating rules around data compliance, privacy and data adequacy.
“It supports innovation but there must be safeguards and protections for using personal data and publicly available content.”
He also stressed the importance of retaining the UK’s EU data adequacy decision, which is estimated to be worth up to £161bn a year to the economy.
Despite claims that the agreement with the EU is safe, European civil society organisations recently wrote to the European Commissioner Michael McGrath asking that the Commission re-evaluate the deal in light of the Data Act.
Last month, it was reported that the agreement – due to expire on June 27 – had been extended for six months by the European Commission to December 27, 2025, in a move intended to provide time for the UK to finalise the data protection reforms.
However, Jeffery has called on continued vigilance. He said: “This (deal) is crucial to provide confidence to UK businesses, lawyers and clients and ensure that England and Wales remain the global jurisdiction of choice.”
Jeffery also pointed out that “wider data considerations still to be debated, including copyright rules and AI regulation, should aim to protect and benefit the public, fairly balancing the interests of content creators and tech developers”.
The Law Society’s intervention comes as the ICO has said UK businesses will only have a six- to nine-month window to implement the Act. This is compared to the two years businesses had to prepare for GDPR, which was adopted in 2016, but came into effect on May 25 2018.
While there has been no confirmation of actual dates, the first changes are expected by mid-December and most major guidance set for release in winter 2025/2026. Key updates will address lawful bases, complaint handling, research provisions and consent requirements for advertising.
The only meassure which has been implemented immediately regards data subject access requests, with the wording being changed to say that “only reasonable and proportionate” data requests need to be handled. Data controllers can also now charge a “reasonable fee” for additional copies of the information.
The Government insists it will phase in the rest of the changes but UK firms are notoriously slow in adopting new data laws, with a mad rush – similar to that seen with GDPR – likely to ensue. With much of the forthcoming guidance dependant on how the ICO interprets the new provisions, at the moment organisations are being advised to monitor developments and review current practices. Whether they will, however, remains to be seen.
The regulator has also been quick to point out that the Data Act amends, but does not replace the UK GDPR, the Data Protection Act 2018 (DPA) and the Privacy & Electronic Communications Regulations (PECR).
One of the longer-term changes is the replacement of the current Information Commissioner’s Office with a new Information Commission, which will have a corporate structure similar to Ofcom, with a chief executive and board. The change is expected to take effect in 2027.
Related stories
DMA claims Data Act victory as privacy groups seethe
ICO unveils business guidance as Data Act becomes law
Four years in the making, UK data reforms are passed
Peers stand firm as data reforms ‘ping pong’ continues
Ministers invoke 1678 law to block AI copyright protest
Data reforms hit as Lords mount revolt over AI copyright
Data reforms inch closer but Govt fails to defuse AI row
‘Henry VIII’ clauses threaten to derail data reform bill
Lords on alert over EU deal as Data Bill concerns grow
