The UK's Data (Use and Access) Bill passed Parliament on 11 June 2025, and is now awaiting Royal Assent. This bill proposes some amendments to the current UK GDPR, though it does not differ significantly.
Some Differences from Current GDPR:
- New identification for 'Legitimate Interest': no need for Legitimate Interest Assessments if processing data under these new, recognised interests
- New "not materially lower" data transfer standard replaces "essentially equivalent" protection for third countries
- Revised rules for Automated Decision Making processing
- Modified Data Subject Access Requests: new information requirements when data is withheld based on legal privilege
- New rules on what constitutes special category data
- Reviews to cookie banners
The European Commission is closely monitoring these changes, and has decided to extend the UK adequacy decision for the rest of the year after which it will review the UK's adequacy status.
Let's keep an eye on these changes.
