The UK’s new data protection laws give the green light for businesses to turbocharge marketing and customer engagement, but marketers can only capitalise with a fresh, data-led strategy.
That is the rallying cry from data intelligence company Sagacity, whose data quality and governance manager Andrew Bridges insisted: “This is a gold rush: a once-in-a-generation opportunity.”
While the UK Data (Use & Access) Act 2025 has been on the Statute Book since June, it will still be some time before the key regulations – including UK GDPR, the Data Protection Act 2018, and the Privacy & Electronic Communications Regulations (PECR) – will be amended.
These updates will legally clarify the use of “legitimate interest” as a lawful basis for direct and data-driven marketing.
And Bridges, who is also a member of the DMA Governance Committee, is keen to stress that there has never been a better time for marketers to get in shape.
He explained: “Until now, around half of businesses have been nervous and unclear about whether they could process customer data under ‘legitimate interest’ – and with the risk of damaging fines, it’s easy to see why.
“The Data Act changes that, giving businesses the legal clarity to use data confidently, whether that means reconnecting with lapsed customers or reaching new audiences. With regulatory updates imminent, now is the time for businesses to get ready.”
Sagacity advises businesses to follow a robust plan, including establishing clear audit trails and properly permissioned records.
The company points out that the Act will ramp up PECR penalties to the same level as UK GDPR (£17.5 million or 4% of annual worldwide turnover, whichever is higher), making it more important than ever to understand and respect customers’ marketing preferences.
Businesses will also be able to confidently process third-party data to identify new prospects, and supplement existing customer records, under the lawful basis of legitimate interest.
Enriching databases with fresh insights like household make-up, address changes or working status can help understand why customers have lapsed, and open upsell opportunities, the company argues.
Bridges, who was chair of the DMA’s Data (Use & Access) Bill Taskforce, added: “The opportunity is huge – but businesses must rethink how they handle customer data or risk falling behind.
“Although compliance comes into the spotlight under the Act, businesses don’t just need to think about their own data. To really take advantage, they need a hybrid approach, mixing existing records with third-party insights.
“This can drive smarter, more relevant engagement with both existing and potential customers – making a tangible impact on the bottom line.”
Related stories
ICO plans triage system to tackle complaints emergency
Lawmakers urged to act on ‘severe’ failings of the ICO
Complaints to the ICO soar as performance takes a hit
The £161bn question: Will EU renew data transfer deal?
DMA claims Data Act victory as privacy groups seethe
ICO unveils business guidance as Data Act becomes law
Four years in the making, UK data reforms are passed
