The Data Use and Access Act 2025
Changes to the bill and support available from the Department for Education (DfE).
Schools are reminded that the requirements under the Data (Use and Access) Act (DUAA) have come into force. This Act does not replace existing data protection legislation but amends and builds on UK GDPR, the Data Protection Act 2018 and Privacy and Electronic Communications Regulations, strengthening and refining expectations around how personal data is handled, shared and protected.
In practice, this means ensuring that any use of pupil, staff or parent data is lawful, transparent and secure, with appropriate safeguards and clear accountability in place. The Act reinforces individuals’ rights and expectations around how their data is accessed and used, including greater clarity around lawful bases for processing by introducing the lawful basis ‘recognised legitimate interests’. Plus expanding the circumstances in which automated decision-making can be used.
The changes also place greater emphasis on how data protection complaints are managed, meaning schools are required to have clear, accessible processes for individuals to raise concerns and ensure these are handled promptly and effectively.
Schools should review their existing data protection procedures to make sure they align with these updated requirements, including:
- how personal data is collected, shared and accessed
- the lawful basis relied upon when processing personal data
- staff awareness of their responsibilities and obligations
- how complaints about the processing of personal data are handled
DfE will provide more information in due course.
For further guidance and practical support, refer to the Information Commissioner’s Office (ICO), which provides up‑to‑date advice and resources to help organisations comply.