Legislation: Section 80 – Automated decision-making | Schedule 6 – consequential amendments

The DUA Act introduces a more flexible framework for significant decisions made solely by automated processing. A decision is considered solely automated where there is no meaningful human involvement, and significant where it produces a legal or similarly significant effect on the individual.

For personal data that is not special category data, the previous restrictions have been relaxed. However, the new Recognised Legitimate Interests lawful basis cannot be relied upon for this type of decision. Tighter restrictions continue to apply where special category data is involved.

Safeguards still apply to significant solely automated decisions. Individuals must be provided with information about the decision and be able to make representations, obtain human intervention and contest the decision.

What to check: Find out where automated decisions or profiling are actually taking place. Look beyond IT: recruitment, fraud, credit, marketing and AI-enabled systems are obvious areas to consider. Ask whether the system is making the decision or simply supporting a person, and whether any human review is genuinely meaningful.

Legislation: Section 76 – time limits and clarification | Section 78 – reasonable and proportionate searches

The Act largely clarifies the existing SAR position. Organisations are expressly required to carry out a reasonable and proportionate search, and the response period can be paused where further information is reasonably required before the organisation can respond.

What to check: Sense-check your existing SAR procedure rather than rewriting it from scratch. Make sure staff understand when clarification is genuinely needed, when the clock can be paused and how the business identifies where relevant personal data is held.

Legislation: Section 103 – complaints by data subjects | Schedule 10 – complaints amendments

Controllers must now take appropriate steps to facilitate data protection complaints, including providing an appropriate means for people to complain electronically. Complaints must be acknowledged within 30 days.

Controllers must also take appropriate steps to respond to complaints without undue delay, including investigating the subject matter of the complaint, keeping the individual informed of progress and informing them of the outcome.

What to check: If a complaint arrived tomorrow, would staff recognise it, know where to send it and know who owns the response? Check that complaints can be recorded, investigated and tracked through to an outcome.

Legislation: Section 112 – storing and accessing information on devices | Schedule 12 – cookie and storage exceptions

The DUA Act introduces additional exceptions to the usual consent requirement for cookies and similar technologies. These include certain uses for statistical purposes and to adapt or enhance the appearance or functionality of a website.

The exceptions are subject to conditions. For example, the statistical and website functionality exceptions require users to be given clear and comprehensive information and a simple, free means of objecting.  These changes do not make behavioural advertising, advertising-related tracking or general cross-site tracking consent-free.

What to check: Test your website rather than relying on what the Cookie Policy says. Check what loads before consent, whether rejecting or withdrawing consent works and whether the banner, policy and technologies actually in use all match.

Legislation: Section 115 – PECR enforcement | Schedule 13 – Commissioner’s enforcement powers

The DUA Act significantly strengthens the regulator’s PECR enforcement powers and aligns the penalty regime more closely with the DPA 2018.

For PECR infringements subject to the higher maximum, the maximum penalty is £17.5 million or, for an undertaking, 4% of total annual worldwide turnover, whichever is higher. Other PECR infringements are subject to the standard maximum of £8.7 million or 2% of total annual worldwide turnover, whichever is higher.

What to check: Cookies and electronic marketing are sensible areas for a relatively quick compliance review. Check that consent, opt-outs and suppression processes actually work in practice.

Legislation: Section 85 – international transfers | Schedule 7 | Schedule 8 | Schedule 9

The mechanisms used to transfer personal data internationally remain, but the legal test has changed.

The new data protection test considers whether the standard of protection after the transfer would be “not materially lower” than the standard available under UK data protection law. When using appropriate safeguards, controllers and processors must act reasonably and proportionately when considering that test.

What to check: There is no need for a wholesale rewrite of historic assessments simply because the test has changed. Apply the new test when setting up or reviewing transfers — and make sure you know where international transfers are happening in the first place.

Legislation: Section 70 – lawfulness of processing | Schedule 4 – Recognised Legitimate Interests

A new lawful basis, Recognised Legitimate Interests, has been introduced for a limited number of specified purposes.

Unlike ordinary legitimate interests, the usual balancing exercise is not required, although the processing must still be necessary for one of the recognised purposes. These are narrowly defined and are unlikely to cover most routine commercial activity.

The Act also clarifies that activities such as direct marketing, intra-group administrative transfers and network and information security may constitute legitimate interests under the existing Article 6(1)(f) basis. The normal balancing exercise still applies.

Legislation: Section 67 – research and statistical purposes | Section 68 – consent for scientific research | Section 71 – purpose limitation and re-use | Section 86 – research safeguards

The Act clarifies when personal data may be re-used for another purpose and provides greater clarity around scientific research.

This includes expressly recognising that scientific research may be commercially funded or undertaken and clarifying when broader consent may be used where the precise purposes of scientific research cannot be fully identified at the outset.

Legislation: Section 81 – children’s higher protection matters

Providers of information society services likely to be accessed by children must expressly consider children’s needs when designing and implementing how personal data is processed.

This includes recognising that children may have different awareness of risk and different needs depending on their age and stage of development.  This sits alongside, rather than replaces, the existing Children’s Code.

Legislation: Section 114 – electronic marketing by charities

The Act introduces a specific electronic-marketing exception for qualifying charities.

Subject to the statutory conditions, a charity may market its charitable purposes to somebody whose details it obtained when that person expressed an interest in, or offered or provided support for, those purposes. A simple opt-out must be offered when the details are collected and in each subsequent communication.