Google searches for UK’s Data Use and Access Act surge 16,000% with HR leaders urged to roll out staff training to prepare for August enforcement deadline.
VinciWorks has identified a 16,000% month-on-month increase in Google searches for “Data Use and Access Act” in June 2025, the month the legislation became law on 19 June. This spike highlights how seriously UK organisations are taking the changes to data protection law.
The Data (Use and Access) Act 2025 (DUAA) revises UK GDPR and PECR regulations by introducing stricter DSAR handling rules; higher marketing penalties; and updated automated decision-making protections. It also establishes digital identity frameworks and Smart Data schemes. Crucially for HR leaders, the reforms will affect every department handling personal data, from HR, recruitment and payroll to marketing, sales, and operations.
The next compliance milestone arrives on 20 August 2025, when the ICO gains powerful new investigative rights, including compelling staff interviews and requesting internal documentation.
“The DUAA changes are immediate and far-reaching,” said Nick Henderson-Mayo, Head of Compliance at VinciWorks. “HR leaders cannot treat this as just an IT issue; it’s an all-staff responsibility. Organisations should be implementing DUAA-compliant processes and delivering staff training now to avoid early enforcement risk.”
Immediate priorities for HR and compliance teams
- Update DSAR processes – Apply proportionality rules and use the new “stop-the-clock” mechanism.
- Embed DUAA training – Covering all staff who process or manage personal data, including HR, finance, marketing, legal, operations, and frontline teams.
- Review data privacy policies – Ensure privacy notices, contracts, and retention policies reflect the new lawful processing bases.
- Prepare for regulatory scrutiny – With expanded ICO powers, record-keeping and compliance evidence must be audit-ready.
Implementation timeline snapshot
- Now – Review DSAR procedures; roll out DUAA/UK GDPR training.
- 20 August 2025 – Review DSAR procedures; roll out DUAA/UK GDPR training.
- By December 2025 – Begin Smart Data and digital identity readiness.
- By June 2026 – Achieve full compliance across all DUAA provisions.
The DUAA marks a decisive moment in UK data protection, with implications for every organisation and every employee who handles personal data. HR leaders must ensure staff are ready, and the time to start is now.
VinciWorks is providing organisations with a free checklist on the essential steps HR and compliance leaders need to take to stay compliant with the Data (Use and Access) Act.
The Data (Use and Access) Act compliance – What’s changed in UK data protection webinar takes place on Wednesday 10th September at 12pm UK.
VinciWorks compliance experts will break down the practical impact of the DUAA on organisation’s data protection strategy. VinciWorks will be covering how organisations can adapt existing GDPR and DPA 2018 compliance frameworks, avoid missteps, and ensure the organisation is prepared for the future of data protection. Register now.
