The Data Use and Access Act 2025 (DUAA)

[Alis_Klar]

This one just crept up on me.  New Act coming into force June 2025!

 

Big changes to GDPR to water down many things but also adds new responsibilities.

 

https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/

 

[PotNoodleTech]

Wow that one is under the radar I bet no one in my school knows about it!!

 

 

Edited June 23, 2025 by PotNoodleTech

[GrumbleDook]

There are a few changes that will benefit schools.

There are a few folk discussing it, but https://www.brownejacobson.com/insights/data-use-and-access-act-2025-what-you-need-to-know is probably the simplest one to share with you senior leadership/DPO. 

From a vendor point of view (as a data processor for the school) it increases the need for transparency, and there are a few items needing secondary legislation to enact, but some of those are a separate discussion. The important bit from a relationship position as you do due diligence on your supply chain (CE+ requirement) is that your data processors only process what is in your agreement with them. Nothing has really changed there.

[synaesthesia]

Will certainly be giving that a good read later; am I right in thinking it might help clarify the position of schools regarding what safeguarding data is eligible for inclusion? I can't remember the name they gave it (something like official authorities), but with some queries about what bits from MyConcern/CPOMS can be included it may help clarify.

[PotNoodleTech]

We were told this:

 

"The changes made under The Data Use and Access Act 2025 (DUAA) offer organisations the opportunity to do things differently, rather than needing to make specific changes to comply with the law.  The changes will be phased in between June 2025 and June 2026. Not all of the changes will relate to schools. We will inform schools of any changes when they come into force and will explain how to maintain compliance."

 

I.e. no need to panic

[GrumbleDook]

Public Task, as a lawful basis, includes tasks completed in the public interest or undertaken through the organisation's official authority. 

The official authority is set out in education legislation and SoS instructions (including things like KCSIE), or other legislation which affects children within a school environment or school activities.

Within England, the requirements for schools as set out by Ofsted also come into play (similar is in effect for Wales and Scotland, and NI is a bit more complicated).

One area that could change is around research and direct marketing, but that will come under secondary legislation really.