Data (Use and Access) Act 2025: an update to data protection law - what charities need to know

In this article we assess the data protection changes contained within the Data (Use and Access) Act 2025 and what these means for charities.

The Data (Use and Access) Act 2025 received Royal Assent on 19 June, making some tweaks to data protection law. This article outlines the data protection changes and how these are likely to affect charities’ data protection compliance.

Background

The Data (Use and Access) Act 2025 started life in 2022, it has since had three fresh drafts, a general election and countless amendments.

After some debate on non-data protection law provisions in the Act, the government finally pushed the legislation through, meaning the less contentious data protection changes can now also make their way onto the statute book.

Changes to data protection law

The Act is not a wholesale change to data protection law, but does make some significant changes around the edges which will be of interest to those with data protection responsibility within charities.

There is also a more significant change to the regulations governing email/text marketing for charities within the Act.

Most changes will not take effect immediately (most will come into force within the next 2 to 6 months, according to the ICO), but below we summarise the data protection changes to come:

• Creation of ‘recognised legitimate interests’: such recognised legitimate interests will not need an assessment balancing the rights and freedoms of the individual in the same way as most legitimate interests. These will be limited (at least at first) to safeguarding, crime and other emergency disclosures.

• Complaints reform: there will now be a requirement for controllers of personal data to provide a complaints process for responding to data protection complaints before such a complaint goes to the ICO.

• Introduction of proportionality when responding to data subject access requests: the requirement for controllers to search their systems will now require controllers only to conduct a “reasonable and proportionate search for the personal data and other information” required to be disclosed. It remains to be seen how much of an effect this will have in practice on the obligation to undertake a search for information under the data subject access regime.

• Automated decision making: there are some changes which may make it easier for organisations to utilise automated decision making (i.e. where technology makes decisions without human involvement), provided appropriate safeguards are in place. Time will tell whether these changes will significantly alter the ability to use automated decision making.

• Goodbye Information Commissioner’s Office, hello Information Commission: a structural reorganisation will take place meaning the ICO will become the Information Commission. Not much will change for those interacting with the Information Commission, but it represents a reform of the UK’s data protection regulator.

• EU-UK data sharing: the Act was pushed through to give the legislation chance to bed in before the EU reviews its adequacy decision for the UK (i.e. its conclusion that the UK has appropriate data protection legislation to allow data sharing between the two jurisdictions as if it was within the EU). The EU is due to review the adequacy decision by the end of the year.

Soft opt-in for charities

The Act will make changes to make it easier for charities to send marketing to donors and supporters via email and text.

As a general rule, most marketing communications sent to individuals via email or text can only be sent with the user’s prior consent, which must have been obtained by the individual actively ‘opting in’ to receiving the communication.

There has long been a so-called “soft opt-in” available to businesses to market products and services to individuals where they have either purchased/enquired about purchasing similar products or services in the past.

The way in which the soft opt-in was structured did not permit charities to rely on it to send email/text marketing promoting its purposes or seeking donations to those who previously engaged with them.

After much to-ing and fro-ing, which has seen the provisions in and out of the various data protection reform bills in the last couple of years, the legislation now opens up this soft opt-in to charities provided:

1. You are sending the communication to further the charity’s purposes via text or email;

2. The charity obtained the contact information of the recipient because they expressed support or an interest in the charity’s purposes;

3. The charity gave the individual the opportunity to opt out of receiving marketing at the time of collection and in all future marketing correspondence. 

Next steps

Over the next few months. the effect of changes will become clearer and there will be several steps for charities to take.

• Charities should update their complaints policies to ensure they reference data protection complaints.
• As the changes come in, there may well be updates that can be made to privacy notices and processing activities to rely on recognised legitimate interests or to take greater advantage of automated decision making.
• Finally, if charities are looking to rely on the soft opt-in, it will be important to ensure an opportunity to opt out of marketing is given at the point of contact information collection going forward. If that opportunity to opt out hasn’t been given at the point of collection the contact details cannot be used for marketing purposes on the basis of a soft opt-in going forward.

If you would like to discuss any aspect of this article further, please contact the charities and social economy team on 0113 244 6100.

You can also keep up to date by following Wrigleys Solicitors on LinkedIn.

The information in this article is necessarily of a general nature.  The law stated is correct at the date (stated above) this article was first posted to our website.

Specific advice should be sought for specific situations. If you have any queries or need any legal advice please feel free to contact Wrigleys Solicitors.