Compliance tools · Cybersecurity and data protection

DUAA 2025 compliance tool

Data (Use and Access) Act 2025 · United Kingdom · Binding instrument

Name anyone on your staff. The system makes them your compliance person.

A member of your own staff, with no compliance background, reads the training module, answers the interview, and finishes with your DUAA 2025 documentation cited article by article. The knowledge stays in the business.

Every account level runs inside a dedicated Claude account. Anyone can try a toolkit in their own Claude account; compliance work runs in a dedicated one. The Claude Max plan is £90 a month, paid to Anthropic, and is not included in any level.

See a finished report before you pay

DUAA 2025 is Data (Use and Access) Act 2025, a binding instrument in the United Kingdom. Amendments to UK data protection covering smart data schemes and digital verification.

DUAA 2025 binds institutions and the largest operators. The free assessment states in ten minutes whether it binds you.

Screen your business against all 116 agent toolkits, free →

• Your exact position under DUAA 2025: what is in place, what is missing, and what to do about each gap.
• Documentation with article citations, ready for auditors, insurers, customers and public buyers.
• A trained person inside the business who understands what the regulation requires, and stays.
• A dated record of every section completed, with the reports themselves staying in your own Claude account. The toolkit is carried by an account level, see the plans.
• All of it completed in-house, at your own pace, without booking a single meeting.

Check that DUAA 2025 applies to your business, free →

Does DUAA 2025 apply to my business?

The Act applies to you if you process personal data as a controller or processor under the UK GDPR and the Data Protection Act 2018, because Part 5 amends those instruments. It also applies if you run a digital verification service, hold apparatus in streets, provide health or adult social care IT, or operate in a sector later designated under Part 1.

Who does DUAA 2025 apply to?

It binds controllers and processors under the UK GDPR and the Data Protection Act 2018, competent authorities doing law enforcement processing, registered digital verification service providers, public electronic communications providers and marketers, charities using electronic mail for direct marketing, undertakers with street apparatus, relevant health and adult social care IT providers, and regulated online safety services.

Does DUAA 2025 apply to a small business?

The Act has no size threshold, no small business exemption and no turnover relief. The Act sets no minimum employee count and no minimum turnover, and it reaches every United Kingdom organisation that processes personal data.

When does DUAA 2025 apply from, and what are the deadlines?

Commencement is phased under section 142. The main data protection package took effect on 5 February 2026 under S.I. 2026/82 regulation 2, the data subject complaints regime under section 103 starts on 19 June 2026, and raised PECR penalties apply from 5 February 2026.

What does DUAA 2025 require me to do?

You must handle subject access requests using a reasonable and proportionate search under section 78, answer data subject complaints with acknowledgement within 30 days under section 103, and give safeguards for solely automated significant decisions under section 80. You must also meet the amended cookie consent rules under section 112 and the transfer assessment duty under section 85.

What records or documents does DUAA 2025 require me to keep or produce?

You must keep a complaints log recording receipt, acknowledgement, steps taken and outcome communications, document your subject access search methodology under section 78, and hold a transfer register with the safeguard instrument and data protection test assessments under section 85. You also need a cookie and tracking audit mapped to each consent basis or exception.

What happens if I do not comply with DUAA 2025?

Infringements of the amended UK GDPR and Data Protection Act 2018 carry the section 157 maxima of 17,500,000 pounds or 4 per cent of worldwide annual turnover, whichever is higher, or the standard maximum of 8,700,000 pounds or 2 per cent. PECR penalties rise to those levels from 5 February 2026 under section 115 and Schedule 13.

How is DUAA 2025 different from PECR 2003?

The DUAA 2025 amends the PEC Regulations rather than replacing them, and it raises PECR penalties from 500,000 pounds to UK GDPR levels from 5 February 2026 under section 115 and Schedule 13. The PEC Regulations remain the operative instrument for cookies, marketing calls and electronic mail marketing.

How do I start complying with DUAA 2025?

Start with the data subject complaints duty: from 19 June 2026 every controller must take steps to make complaints easy to raise, such as providing a complaint form which can be completed electronically and by other means, under section 103 and section 164A of the Data Protection Act 2018.

Which ComplianceSME account includes the DUAA 2025 toolkit?

The DUAA 2025 agent toolkit is included in Compliance Complete.

Related in cybersecurity and data protection: GDPR · ePrivacy Directive · NIS2 Directive · CER Directive