Data (Use and Access) Act 2025
Statute
United Kingdom
· 2025
The DUAA amends UK GDPR, the Data Protection Act 2018 and PECR, replaces the ICO with the Information Commission, and creates statutory smart-data schemes that generalise the open-banking model to any sector a regulation names. It is the point at which UK data protection stops being a copy of the EU's and starts being a different regime, which is a problem for anyone whose compliance model assumed the two moved together.
Horizontal regime. It binds companies by what they do with data, software or
customers, not by the sector they sit in. The industries below are where it creates
specific, additional duties — not the limit of who has to comply.
Countries
Where this binds. Each links to the providers apis.io has catalogued there.
Regions
Industries
Each links to that industry as a scored cohort — so the question "how ready is this sector for the regime that governs it?" becomes one you can actually look at.