The Data (Access and Use) Act 2025: What Small Businesses Need to Know (and Do) Now

by Michelle | 20 06 25 | Data Protection & Business Standards

Well, third time lucky. New data protection legislation has (finally) been given royal assent. You might have seen headlines this week about the Data (Access and Use) Act 2025 (DUAA). I say third time lucky; this is the third time a data protection bill has been put forward, but the only one that has made it to legislation. It’s being called the biggest data protection update since GDPR—but before you panic, take a breath. This new law is more evolution than revolution.

The DUAA is not an overhaul. It is tweaking GDPR and DPA. Think of it as a refresh of UK GDPR that aims to make data protection more straightforward, more business-friendly, and supportive of innovation, all while keeping people’s rights front and centre. Most of the changes are designed to give you more flexibility, rather than introducing new, unfamiliar obligations.

So, what does this mean for your business? Let’s break it down.

What is the Data (Use and Access) Act?

The Data (Access and Use) Act 2025 was passed to amend (not replace) key pieces of data law in the UK:

• The UK GDPR
• The Data Protection Act 2018
• And the Privacy and Electronic Communications Regulations (PECR)

The goal? To support innovation and growth, particularly for businesses using data in creative or technology-driven ways, while still safeguarding personal information and individual rights.

The changes will be phased in between June 2025 and June 2026, giving everyone time to adjust.

What’s Changing?

Here are some of the key updates that may affect small businesses like yours:

1. Simplified lawful bases for processing

A new category—“recognised legitimate interests”—has been introduced. This means that for certain activities (like safeguarding national security or preventing crime), you no longer have to go through a balancing test to justify your use of personal data.

While this won’t affect most day-to-day SME operations, it signals a shift toward making data protection less burdensome.

2. Clarity around scientific research and reuse

If you conduct research or support organisations that do, there’s now clearer guidance on using personal data—including the ability to reuse data without fresh privacy notices (as long as safeguards are in place). This also supports businesses that use AI or develop digital tools that rely on data insights.

3. Cookie consent relaxed

You can now use cookies for analytics and certain functional purposes without explicit consent, so long as they don’t infringe on users’ rights. This could make your website smoother and less reliant on constant pop-ups.

What this means for you: You’ll still need a cookie policy, but you might be able to reduce the number of consent requests, making your site feel more user-friendly.

4. More flexibility with direct marketing

It’s now clearer that direct marketing can be considered a legitimate interest—something many of us assumed, but it’s helpful to have this confirmed in law. For charities, there’s even a new “soft opt-in” right for electronic marketing if someone has shown interest in their cause.

5. Changes to Subject Access Requests (SARs)

The DUAA introduces a more proportionate approach to SARs. You only need to conduct reasonable and proportionate searches, which helps reduce the admin burden, particularly for small teams.

6. Children’s data responsibilities

If you run an online service likely to be accessed by children, there is now an explicit legal duty to consider their needs. If you’re already aligned with the Age Appropriate Design Code, you’re on the right track—but it’s a good moment to double-check.

7. Stronger complaint-handling expectations

You’ll be expected to:

• Offer an accessible way for people to raise concerns (think: a contact form or email address)
• Acknowledge complaints within 30 days
• Respond without undue delay

This aligns with good customer service anyway, but now it’s a compliance requirement.

What’s Not Changing?

Notably, the UK GDPR remains in effect.

If you’ve already taken steps to get your policies, privacy notice, and practices in shape, you’re not starting from scratch. The DUAA adds clarity and flexibility, but the foundations of data protection (transparency, fairness, purpose limitation, security, rights) are still intact.

What Do Small Businesses Need to Do Now?

Here’s a practical checklist for small businesses getting ready for the DUAA:

✅ 1. Familiarise yourself with the key changes

Understanding what’s changing gives you the confidence to act without feeling overwhelmed. Start by reading the ICO’s DUAA guidance or using this blog as your reference point.

✅ 2. Review your privacy notice

Now is a great time to review your privacy notice to ensure it is clear, accessible, and comprehensive, covering all the ways you process data, including analytics cookies, marketing, and complaint handling.

✅ 3. Check your cookie use

Are you using cookies for website stats or performance improvements? You may now be able to rely on the new exemption, saving you (and your website visitors) some extra clicks.

✅ 4. Assess your complaint-handling process

Make it easy for individuals to raise concerns. Consider a simple form on your website or a clear email contact. Ensure your team is aware of the 30-day response requirement.

✅ 5. Double-check any services used by children

If your products or services are likely to be accessed by children—even unintentionally—you’ll need to consider this explicitly. Review the Age Appropriate Design Code if this applies to you.

✅ 6. Stay informed

The ICO is updating its guidance gradually between now and 2026. Sign up for their newsletter or follow trusted advisers (like me!) to stay ahead without being overwhelmed.

A Word of Reassurance

I know what it feels like when new legislation lands—it can seem like yet another thing to add to the never-ending small business to-do list. But this law isn’t here to trip you up.

The Data (Use and Access) Act 2025 aims to make things simpler, not scarier.

If you already have your data protection basics in place—clear policies, secure systems, a lawful basis for marketing—you’re in a strong position. Use this moment as a chance to refresh rather than rebuild.

Need a Hand?

If you’d rather not wade through guidance documents or wonder what counts as “reasonable effort,” you don’t have to do it alone.

I help small businesses simplify data protection with real-world advice, done-for-you documents, and affordable training.

📩 Book a free call to see how we can help you understand what DUAA means for your business—and how to stay compliant, confident and focused on what you do best.

Michelle Molyneux Business Consulting Ltd
Making data protection doable for growing service-based businesses.
Friendly. Expert. Non-jargon. Always on your side.

Common Data Protection Mistakes and How to Avoid Them

by Michelle | 24 01 25 | Data Protection & Business Standards

Protect Your Small Business from Costly GDPR Errors

Are You Making These Data Protection Mistakes?

Data protection is a big deal for small businesses, but many owners and teams unknowingly make mistakes that could lead to fines, reputational damage, or data breaches.

The problem? Most mistakes are avoidable—they often come down to a lack of awareness, poor habits, or outdated practices.

But here’s the good news: fixing these mistakes is quick and simple once you know what to watch out for.

✅ In this blog, we’ll cover:

• The most common GDPR and data security mistakes small businesses make

•Real-life examples of where things went wrong

•Practical solutions to avoid fines, breaches, and compliance issues

Let’s make sure your business stays protected, compliant, and trusted. 🚀

1. Not Having a Clear Privacy Policy

Many small businesses collect customer data without having a proper Privacy Policy in place. This is a legal requirement under GDPR—and failing to provide one can lead to complaints or even fines.

🔹 What’s the Risk? Customers may feel uncomfortable sharing their details, and the ICO (Information Commissioner’s Office) could investigate if someone raises a concern.

💡 Real-World Example: A UK small business was fined £40,000 for not having clear consent policies in place for collecting customer data.

✅ How to Fix It:

✅ Write a simple Privacy Policy that explains:

•What data you collect

•Why you collect it

•How customers can request access or deletion of their data

✅ Make it accessible—place a Privacy Policy link in your website footer and on sign-up forms.

📌 Helpful Resource: You can use the ICO’s SME GDPR Guide to check what should be included.

2. Keeping Data for Too Long (Or Not Knowing When to Delete It)

It’s easy to store old customer data indefinitely—but GDPR requires businesses to only keep data for as long as necessary.

🔹 What’s the Risk? Holding onto unnecessary data increases your security risk. If there’s a breach, old data could be exposed.

💡 Real-World Example: A UK company was fined for holding customer data years after it was no longer needed. They had no formal deletion process, meaning data was stored indefinitely.

How to Fix It:

✅ Set up a Data Retention Policy—decide how long you need to keep different data types.

✅ Delete old customer records, email lists, and unused files regularly.

✅ Automate data deletion using CRM or cloud storage tools.

💡 Tip: If you don’t need it, securely delete it!

3. Sending Personal Data Over Email Without Protection

Many businesses send sensitive data via email without realising how risky this is. If an email is hacked, forwarded, or sent to the wrong person, it can lead to data leaks.

🔹 What’s the Risk? Data sent in plain emails is vulnerable to cyberattacks. Once it’s sent, you can’t take it back.

💡 Real-World Example: A small law firm accidentally emailed client records to the wrong recipient, leading to an ICO investigation.

How to Fix It:

✅ Use encrypted email services for sending sensitive files.

✅ Double-check email recipients before hitting send.

✅ Use secure file-sharing tools like OneDrive or Dropbox instead of email attachments.

💡 Tip: If you need to send password-protected files, send the password in a separate message!

4. Using Weak Passwords or No Multi-Factor Authentication (MFA)

A weak password is like leaving your front door unlocked—it’s an open invitation for hackers.

🔹 What’s the Risk? A leaked password could give attackers access to your business systems, emails, or customer data.

💡 Real-World Example: A UK SME was hit with a cyberattack because their staff used weak passwords without two-factor authentication. Hackers stole customer payment details, causing substantial reputational damage.

How to Fix It:

✅ Use strong, unique passwords for each system (at least 12 characters, a mix of letters, numbers, and symbols).

✅ Enable Multi-Factor Authentication (MFA) for email, CRM, and cloud accounts.

✅ Use a password manager instead of writing down passwords.

💡 Pro Tip: A data breach is often caused by weak passwords—protect your accounts properly!

5. Not Training Your Team on Data Protection

Even if you have great policies, they’re useless if your team doesn’t follow them.

🔹 What’s the Risk? Human error causes 90% of data breaches—usually because staff aren’t trained on security best practices.

💡 Real-World Example: A UK business was fined after an employee clicked on a phishing email, exposing sensitive client data. The company had no cybersecurity training in place.

How to Fix It:

✅ Train your team on phishing, data handling, and GDPR basics.

✅ Encourage a “Speak Up” culture—staff should report security concerns without fear.

✅ Make data protection part of new employee onboarding.

💡 Tip: Even small teams should regularly review data protection best practices!

Final Thoughts: Small Fixes, Big Protection

Most data protection mistakes are avoidable—they happen because businesses aren’t aware of the risks.

But the good news? Small changes can make a huge difference in keeping your business safe, compliant, and trusted.

✅ Quick Recap: How to Avoid Common Data Protection Mistakes

✔ Have a clear Privacy Policy & make it accessible

✔ Set a Data Retention Policy & delete old records

✔ Use encryption or secure file-sharing instead of email for sensitive data

✔ Strengthen passwords & enable Multi-Factor Authentication (MFA)

✔ Train your team & build a culture of security awareness

🔹 Need help securing your business and staying GDPR-compliant? We help small businesses fix their data protection gaps without the legal jargon.

📩 Get in touch today for friendly, practical advice!

Other articles you may be interested;

• Why Every Small Business Needs a Data Protection Plan

• Essential Data Protection Policies for Startups

• Building a Data Protection Culture from Day One

Building a Data Protection Culture from Day One

by Michelle | 17 01 25 | Data Protection & Business Standards

How Small Businesses Can Embed GDPR & Security into Everyday Operations

When you think about an organisation’s culture, data protection probably isn’t the first thing that comes to mind. But, embedding GDPR and security into daily operations from the start can save you from costly mistakes later.

Many small businesses view data protection as a compliance tick-box rather than a core business value. The result? Data incidents and breaches, poor customer trust, and even legal penalties.

But here’s the thing—when data protection is part of your business culture, it becomes second nature. Instead of being a last-minute worry, it’s built into how your team works daily.

We will show you:

✅ Why embedding a data protection culture is crucial for small businesses

✅ How to make GDPR and security second nature in your team

✅ Simple steps to get started—without adding more work to your plate

Let’s make data protection easy and intuitive—so your business stays secure, compliant, and trusted from day one. 🚀

1. Why a Data Protection Culture Matters for Small Businesses

It’s easy to think of data protection as something you only need to worry about in legal documents. But the truth is that how your team handles personal data daily has a more significant impact than policies alone.

💡 Consider This:

• A customer emails their details, and a team member accidentally forwards it outside the company.
• A freelancer downloads sensitive client files onto a personal (unsecured) device.
• A marketing assistant adds customers to a mailing list without their consent.

👉 These are small, everyday mistakes that can lead to big problems.

A strong data protection culture ensures that everyone, no matter their role, understands the risks and follows best practices without hesitation.

💡 Real-World Example: A UK charity was fined £100,000 after staff accidentally shared sensitive data. The ICO found that a lack of training and awareness was the root cause. A better data protection culture could have prevented it!

To understand your legal obligations, the ICO’s SME Data Protection Guide provides clear steps for small businesses to follow

2. How to Embed Data Protection into Your Business Culture

Want to make data protection second nature in your business? Here’s how:

📌 Lead by Example

If business owners and managers don’t take data protection seriously, neither will the team.

✅ Show that data protection isn’t just a legal thing—it’s a business priority.

✅ Follow best practices yourself—use strong passwords, secure devices, and GDPR-compliant processes.

💡 Quick Win: Mention data protection regularly in team meetings so it stays on everyone’s radar.

For practical cybersecurity steps tailored for small businesses, check out the NCSC’s Small Business Cyber Security Guide.

📌 Make Data Protection Part of Onboarding

Training shouldn’t just happen after a mistake is made. New team members should learn about data protection from day one.

✅ Include data security basics in your onboarding checklist.

✅ Make sure freelancers, VAs, and contractors understand your data handling rules.

✅ Use real-life scenarios to teach how mistakes happen—and how to avoid them.

💡 Example: Instead of sending a long GDPR policy, create a quick “5 Key Data Protection Rules” guide for new starters.

📌 Keep Policies Simple & Accessible

Many businesses have great data protection policies, but they’re hidden in a document that no one reads.

✅ Make policies easy to find—store them in a shared folder or intranet.

✅ Write in plain English—avoid legal jargon.

✅ Create short checklists or infographics for key processes (like handling customer data).

💡 Quick Fix: Have a 1-page “Data Protection Do’s & Don’ts” guide that’s easy to follow.

📌 Encourage a “Speak Up” Culture

Data protection mistakes happen constantly—but many employees are afraid to report them.

✅ Encourage openness—let your team know that mistakes should be reported, not hidden.

✅ Make sure there’s a straightforward, blame-free process for handling data incidents.

✅ Celebrate good data protection habits—not just GDPR compliance!

💡 Example: A “Data Protection Champion” in your team can answer questions and keep best practices front of mind.

📌 Automate & Secure Data Handling

One of the best ways to make data protection part of daily business is to automate security wherever possible.

✅ Use secure password managers instead of shared spreadsheets.

✅ Set up automated email encryption for sensitive data.

✅ Enable multi-factor authentication (MFA) on business accounts.

💡 Pro Tip: Automating security reduces human error, making compliance much easier!

3. Making Data Protection Second Nature in Your Business

Here’s a simple checklist to help you embed a data protection culture from day one:

✅ Do I lead by example in following GDPR best practices?

✅ Is data protection included in onboarding for new hires & freelancers?

✅ Are policies simple, accessible, and easy to understand?

✅ Does my team feel comfortable reporting mistakes?

✅ Am I using automation to reduce security risks?

💡 If you answered ‘No’ to any of these, it’s time to strengthen your data protection culture!

Final Thoughts: Make Data Protection a Habit, Not a Hassle

Building a data protection culture doesn’t mean adding extra work—it’s about making security a normal part of your business’s operation.

✅ Start small. Make data protection part of conversations and daily habits.

✅ Keep it simple. Don’t overwhelm your team with complex policies.

✅ Stay proactive. Prevent mistakes before they happen.

Need help embedding a strong data protection culture in your business? We make GDPR compliance simple and practical for small businesses.

📩 Get in touch today for friendly, jargon-free advice!