After months of intense parliamentary wrangling, the UK’s Data (Use and Access) Bill has cleared both Houses of Parliament and now awaits Royal Assent – at which point it will become the Data (Use and Access) Act 2025.

The wide-ranging legislation updates key aspects of the UK’s data protection framework, but its passage was nearly derailed by a heated row over artificial intelligence and copyright.

The Bill, introduced by the Labour government in October 2024, seeks to modernise the UK GDPR and the Privacy and Electronic Communications Regulations (PECR). It establishes clearer rules for digital identity verification, expands the scope of data sharing between organisations, and creates a new framework for non-personal data use.

The Bill also includes updates to how data is used for scientific research, automates decision-making processes, as well as clarifying rules around international data transfers.

However, it’s journey to this point was a contentious one.

The Copyright Clash

Ironically, the most seemingly egregious element of the Bill’s final stages had little to do with data regulation itself. Instead, it became the battleground for a broader cultural and economic conflict – between the AI industry and UK creatives.

A group of high-profile artists, including Sir Elton John, Sir Paul McCartney, and Dua Lipa, supported an amendment proposed in the House of Lords that would have required technology companies to disclose their use of copyrighted material in training genAI models.

Without this amendment, they argued, AI companies would have free rein to scrape content without consent or compensation – potentially undermining the livelihoods of artists and creators.

Sir Elton John, speaking to the BBC, stated that allowing such unchecked use of copyrighted material amounted to “committing theft, thievery on a high scale.”

Despite this, the government held firm. Ministers argued that the issue of AI and copyright is too complex to be resolved through an amendment to the DUA Bill, particularly while a separate consultation is already underway. They also noted that a dedicated AI bill is forthcoming. Realistically though, that bill is going its own through its own legislative hell – with a new, government-supported AI Bill expected next year.

As it stands, the UK Government has agreed to publish a report on AI and copyright enforcement within nine months of the Bill receiving Royal Assent, with an interim update within six months. Although some peers expressed dissatisfaction, the Lords ultimately accepted the compromise, ending the weeks-long back-and-forth and allowing the Bill to pass.

A Win for Pragmatism?

The Centre for Data Innovation welcomed the Bill’s passage, hailing it as a significant victory for measured, evidence-led policymaking.

In a statement, Ayesha Bhatti, head of digital policy for the UK and EU, said: “The passage of the Data Use and Access Bill is a major step forward for the UK’s digital economy. The Bill provides a long-overdue framework for enabling data-driven innovation across sectors—modernising how individuals, businesses, and public services can access, share, and use data.

“Crucially, the Government succeeded in steering the Bill through despite repeated attempts by the House of Lords to impose prescriptive new rules on AI and copyright. In place of premature legislative obligations, the Government has adopted a more pragmatic approach: committing to deliver evidence through a faster reporting timeline, exploring enforcement options, and considering the global nature of AI development.

“This is the right outcome. It is sensible that the Government has chosen not to rush into legislation—particularly while a parallel consultation is already underway. Mandating sweeping new transparency obligations at this stage would have risked unintended consequences for the UK’s AI ecosystem, just as global competition intensifies.

“The passage of this Bill is a win not just for data reform, but for measured, evidence-led policymaking. If the UK is to be a serious AI power, it should continue to resist short-term political pressure in favour of long-term strategic thinking.”

What’s in the Bill?

Despite being overshadowed by the copyright debate, the Bill includes several substantive provisions that will reshape how data is used and regulated in the UK:

• Scientific Research: New definitions and provisions clarify the role of consent and further processing in research.

• Legitimate Interests: Introduces a list of recognised legitimate interests that can be processed without a full Legitimate Interest Assessment.

• Automated Decision-Making: Updates and clarifies ADM rules.

• Data Exports: Replaces the “essentially equivalent” test for third-country data transfers with a “not materially lower” standard—an important shift that has caught the eye of the European Commission.

• ICO Reform: Adjusts the role and responsibilities of the Information Commissioner’s Office.

• Special Category Data: Grants the Secretary of State new powers to redefine what qualifies as special category data.

• PECR Changes: Introduces updates to rules governing cookies and electronic communications.

The Bill also adds a range of practical new measures, including:

• Giving bereaved parents the right to access their deceased children’s data.

• Allowing NHS trusts to share patient data more efficiently.

• Creating a national 3D map of underground infrastructure to reduce disruption during roadworks.

Adequacy Concerns

The Bill’s impact on the UK’s data adequacy status with the European Union remains uncertain. The European Commission has temporarily extended the UK’s adequacy decision to the end of 2025 to allow time for review. While the government maintains that the Bill poses no threat to the adequacy decision, EU civil society groups have expressed concern.

Recommended reading

• UK Gov Using Personal Data to Develop ‘Murder Prediction’ Tech
• Irish Watchdog Probes X Over AI ‘Data Grab’
• ‘Shadow AI’ Use Is Threatening Enterprise Data Security

In a 4 June 2025 open letter to EU Justice Commissioner McGrath, organisations including the Open Rights Group and European Digital Rights warned that the UK was diverging from GDPR standards and called for a re-evaluation of the UK’s status. They cited not just the DUA Bill, but also the Investigatory Powers Act and the use of live facial recognition technology as contributing factors.

What Happens Next?

The bulk of the DUA Bill will be enacted through secondary legislation. However, some parts – such as those amending the UK GDPR and PECR – are expected to come into force quickly.

Organisations should begin reviewing their data subject access request procedures, approaches to automated decision-making, and cookie policies. Those engaged in scientific research or looking to reuse data for additional purposes will need to assess the Bill’s implications closely.

Meanwhile, non-personal data provisions – such as those enabling new data-sharing frameworks – may take longer to implement