Good morning,
We are contacting you about upcoming guidance consultations following the introduction of the Data Use and Access Act (DUAA) that may be of interest to your organisation.
Data Use and Access Act (DUAA)
The ICO is opening a series of consultations on updates to our guidance as part of the implementation of the Data (Use and Access) Act. These include changes to existing data protection laws that will give more confidence to UK businesses to share data in the public interest and support organisations with data protection complaints in line with their legal obligations. We are inviting organisations to share their views on our draft guidance to help make them as clear, practical, and accessible as possible. Further information about the DUAA is available on our website: Data (Use and Access) Act 2025 | ICO.
Recognised legitimate interest guidance consultation
Recognised legitimate interest is a new lawful basis introduced into the UK GDPR by DUAA. It is separate from the legitimate interests lawful basis. Our guidance will help to give organisations more confidence to use personal information for certain purposes in the public interest. Organisations can use recognised legitimate interest for purposes such as crime prevention, public security, safeguarding, emergencies or for sharing personal information to help other organisations perform their public tasks. We are seeking your feedback on the draft detailed guidance. We are inviting you to respond to this consultation.
Guidance for organisations handling data protection complaints
By June 2026, organisations must have a process in place for handling data protection complaints. A complaint can come from anyone who is unhappy with how an organisation has handled their personal information. Our new guidance sets out the requirements and informs organisations of what they must, should and could do to comply. It includes tips and practical advice for each stage in the process. We are inviting you to respond to this consultation.
Upcoming DUAA Consultations
For more information about our planned consultations on guidance updates, please read our guidance pipeline. We will contact you to share details of guidance consultations which we think will be of interest to you.
Research, archiving and statistics provisions
We know that organisations will be keen to learn about the changes to the research, archiving and statistics provisions, and how these changes make it simpler for those carrying out research to use personal information while complying with the law. We are updating our existing guidance to reflect these changes, and will be consulting on a draft version of this guidance in the autumn.
Charitiable purposes ‘soft opt-in’
We know that charities are keen to learn more about using the ‘soft opt-in’ to send direct marketing emails and text messages to further their charitable purposes. We are working hard to provide further information about this new way of sending direct marketing and are expecting to consult on our positions in late September.
We greatly value your input on these consultations. Your feedback will help shape our final guidance and ensure it meets the needs of stakeholders across sectors.
Thank you,
Catherine Evans O’Brien, Head of Communities (Monday to Thursday)
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
T. 0330 313 1845
ico.org.uk twitter.com/iconews
For information about what we do with personal data see our privacy notice