Quarterly BAS Due (July–September)
Form 1099-NEC & Contractor Payment Reporting Check
Why this matters.
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and makes the first significant changes to UK data protection law since GDPR was introduced. It creates a new “recognised legitimate interests” lawful basis that lets businesses process personal data for specific purposes — such as safeguarding, crime prevention, and responding to legal obligations — without carrying out the usual legitimate interests balancing test. It also relaxes the rules on solely automated decision-making, extends the direct marketing “soft opt-in” rule beyond commercial organisations to charities and other non-commercial bodies, eases cookie consent requirements for low-risk purposes like analytics and security, and reforms how Subject Access Requests are handled. The ICO itself is being restructured into the Information Commission, with a chair and board rather than a single Commissioner.
For most UK businesses, these changes mean existing GDPR compliance work needs a fresh look rather than a rebuild. A new requirement to have a clear internal complaints-handling process for data subjects — so people can complain to the business before escalating to the regulator — is now expected to be in place. Businesses using automated tools for recruitment screening, credit decisions, or customer scoring need to reassess whether their safeguards still meet the revised Article 22 rules. And any organisation relying on “soft opt-in” marketing, or claiming legitimate interests as a lawful basis, should check whether the new rules change what they can do — getting it wrong still exposes a business to ICO enforcement action and fines under the existing UK GDPR penalty regime.
