DUAA 2025: The Data Use & Access Act – SME Data Innovation Boost & Compliance Risks

The Data (Use and Access) Act 2025, commonly known as DUAA, is a landmark UK legislation that modernises data protection rules to unlock digital opportunities. Enacted on 19 June 2025, it amends the UK GDPR and Data Protection Act 2018, allowing more flexible automated decision-making and easier data sharing for innovation. For small and medium enterprises (SMEs)—businesses with up to 250 employees and turnover under £50 million—this means enhanced access to smart data schemes and digital identities, but also new compliance demands in a fast-evolving cyber landscape.

Why This Matters

DUAA represents a pivotal shift in how UK SMEs handle data, enabling growth through innovation while demanding robust safeguards against misuse. As SMEs often lack dedicated compliance teams, understanding DUAA now is crucial to avoid fines and seize competitive edges.

*Unlocks Innovation: Facilitates smart data schemes for personalised services, boosting customer engagement.
*Enhances Efficiency: Permits broader automated processing, reducing manual workloads for resource-strapped SMEs.
*Increases Risks: Heightens exposure to data breaches if not managed, with potential ICO penalties up to 4% of global turnover.
*Supports Digital Economy: Aligns with government goals for a tech-driven UK, offering SMEs tools like digital death certificates and public data access.
*Urgent for SMEs: With cyber threats rising 20% annually for small firms, DUAA’s changes make proactive compliance non-negotiable.

Authoritative Insight

The Data Use and Access Act 2025 amends existing data laws to promote responsible data use. According to the Information Commissioner’s Office (ICO), it introduces a more permissive framework for automated decisions without significant legal effects, provided safeguards are in place. The UK Government factsheet highlights key reforms to the UK GDPR, including clearer legitimate interest tests and streamlined international data transfers. Recent analysis from legal experts notes that DUAA simplifies rules for scientific research and e-privacy, easing burdens on businesses.

SME-Specific Impact

SMEs, defined as enterprises with fewer than 250 staff and limited resources, are particularly affected by DUAA due to their agility in adopting digital tools yet vulnerability to regulatory oversights.

*Vulnerability to Fines: Without in-house experts, SMEs risk non-compliance in automated processing, amplifying ICO scrutiny amid rising data incidents.
*Advantage in Agility: Smaller teams can quickly implement smart data for competitive edges, like personalised marketing, unlike larger corporates bogged down by bureaucracy.
*Cost Pressures: DUAA’s emphasis on data security demands investments in training, urgent for SMEs where 43% report cyber attacks annually.
*Growth Opportunities: Access to public data registers empowers innovation, helping SMEs expand digitally without heavy upfront costs.
*Compliance Gaps: Many SMEs overlook legitimate interest assessments;