Latest Posts
Understanding the UK’s Data (Use and Access) Act 2025
The UK’s data protection landscape is continuing to evolve. The Data (Use and Access) Bill (the “DUA Bill”) received Royal Assent last month and has been enacted as the Data (Use and Access) Act 2025 (the “DUA Act”). The DUA Act aims to complement existing UK data protection laws by enhancing transparency, promoting responsible data sharing, and reinforcing the protection of individual rights.
This article explores some of the key changes being introduced by the DUA Act and outlines practical steps organisations can take to prepare for the new legislation and ensure ongoing compliance.
AI and copyright
One of the most hotly contested issues that stalled the DUA Bill’s progress was around the treatment of artificial intelligence (“AI”). The emergence of AI models raised significant concerns, particularly around copyright materials being used by developers for training their Large Language Models.
The House of Lords pushed for amendments to the DUA Bill to include stricter provisions on the use of copyrighted content, advocating for mandatory transparency requirements. Some of the UK’s leading music artists, including Sir Elton John, Sir Paul McCartney and Dua Lipa, spoke out in support of these changes. (Dua Lipa’s high profile involvement even led to the legislation being jokingly referred to as the “DUA Lipa Bill”). These artists warned that, without such safeguards, tech companies could exploit intellectual property and be given free rein to use content without having to compensate the creators.
However, the House of Lords’ efforts were unsuccessful. The Government ultimately resisted the proposed changes, arguing that the DUA Act was not the appropriate legislative vehicle to address such complex and evolving issues. Eventually a compromise was reached and a government report on AI and copyright is due to be published later this year, which will explore possible changes and enforcement measures.
What does the DUA Act do?
The DUA Act establishes a more robust legal framework for data access and sharing. It updates and reforms existing UK data provisions and e-privacy laws and includes broader data policy initiatives aimed to encourage use of data in the public interest, while maintaining safeguards for individual rights to privacy.
Key changes include:
- Establishing new Smart Data Schemes to enable access to customer and business data. This will allow data holders to share data, such as order histories and service logs, with authorised third parties who can use it to provide improved services to the customer.
- Introducing a new structured system for digital verification services by using trusted providers, enhancing reliability and trust in digital ID systems.
- Replacing the former EU-style adequacy framework for international data transfers with a new test. Transfers will be permitted where the receiving country offers protections that are not materially lower than UK standards.
- Making various amendments to existing UK data legislation, such as:
- to introduce a new lawful basis for processing of “recognised legitimate interest”, including for national security and emergency response;
- to allow charities to take advantage of the “soft opt in” when sending marketing emails, thus bringing them more in line with the how businesses can operate;
- to relax the requirement for establishing a lawful basis before conducting automated decision-making where special category data is not involved;
- to clarify the “reasonable and proportionate” standard for responding to data subject access requests (“DSARs”), offering more proportionality and greater flexibility to organisations managing complex / repetitive requests;
- to permit the use of low-risk cookies (e.g., for site performance or analytics), without the requirement for explicit consent, provided users are informed and can still opt-out; and
- to reform the ICO and replace it with the “Information Commission” – intended to give it a more modern structure as a full corporation and bring it in line with other UK regulators like OFCOM and the FCA.
How can organisations prepare?
While some critics argue the DUA Act simply reinforces and codifies existing legislation, the cumulative effect of the changes could be significant from a compliance and operational perspective.
The new Information Commission will be issuing guidance on the DUA Act, but this is not scheduled to be coming out any time soon and may not be until next year. As we await further details and secondary legislation, organisations should take this opportunity to proactively review and assess their existing documentation and policies to ensure a smooth transition.
Recommended steps include:
- Reviewing existing data policies including privacy policies and data protection impact assessments to assess its compliance with the new transparency and accountability requirements and the recognised legitimate interests provision;
- Considering the Act’s clearer reasonable and proportionate test to data subject access request processes and thinking about setting internal policies on what constitutes a reasonable / proportionate search;
- Assessing whether use of cookies will qualify for the new consent exemptions and considering a review of cookie banners and privacy notices accordingly, ensuring opt-out choices remain;
- Considering the appointment of a data protection officer (“DPO”) or compliance lead if not already in place to oversee regulatory compliance, particularly for businesses that operate across multiple jurisdictions; and
- Remembering that this is a change to UK legislation only. Where organisations must comply with other legislation from other jurisdictions, especially GDPR for Europe related activities, these regulations will still remain. Global organisations should consider how best to manage the different approaches when dealing with the UK and Europe.
Final thoughts
The DUA Act is part of a broader trend towards a more flexible and accountability-driven approach to how data is being governed in the UK. While some key aspects, such as AI and copyright, are subject to secondary legislation and further guidance to be published, the direction the Government is taking towards modernisation is clear.
Organisations that begin reviewing and assessing their processes and provisions now, will be better placed to ensure legal compliance and avoid regulatory risk in the future.
Our experienced Data Protection and & Privacy team is available to provide further advice or answer any questions you may have about the DUA Act. Please do not hesitate to get in touch.
Read More
Quastels SRA Diversity Questionnaire 2025
Results for Quastels: Staff SRA Diversity Questionnaire 2025
89% of our staff completed the 2025 Solicitors Regulation Authority (SRA) Diversity questionnaire.
Response to the survey by individuals is encouraged yet voluntary. Staff also have the option to complete the survey whilst choosing not to respond to one or more of the questions.
Where the following data refers to ‘staff’, ‘all staff’ or ‘total staff’ this should be read as ‘all staff who responded to the survey and the question’.
Of those staff who completed the questionnaire, see the results below.
Role Categories
Age Categories of Quastels Staff
Sex of Quastels Staff
Do The Employees At Quastels Identify With The Same Gender They Were Assigned At Birth?
The Equality Act
The Equality Act defines a disabled person as someone who has a mental or physical impairment that has a substantial and long-term adverse effect on the person’s ability to carry out normal day-to-day activities.
Do Quastels Staff Have Problems Or A Disability Impacting Their Day-To-Day Activities?
Ethnicities Of Quastels Staff
What Are The Religious Beliefs Of Quastels Staff?
Sexual Orientation of Quastels Staff
What was the occupation of the main household earner when a Quastels employee was aged about 14?
Which type of school did Quastels staff attend for the most time between the ages of 11 and 16?
Did either parent of Quastels employees attend university and gain a degree (eg BA/BSc or equivalent) by the time they were 18?
Are Quastels staff primary carers for a child or children under 18?
Do Quastels employees look after or care for someone 18 or over with long term physical or mental ill health caused by disability or age (not in a paid capacity)?
Find out more about Quastels’ core values and our Social Impact Programme for 2025.
Read More
Reframing Continuity: The 2025 Changes to EUSS Residence Rules under HC 836
Introduction
On 24 June 2025, the Home Office laid before Parliament Statement of Changes HC 836, introducing a transformative amendment to the EU Settlement Scheme (EUSS). This development marks a significant evolution in how the Home Office interprets and applies the concept of “continuous qualifying residence” for pre-settled status holders seeking settled status. The changes are set to come into force on 16 July 2025.
Previous Legal Framework and Challenges
Historically, under Appendix EU, individuals holding pre-settled status were required to demonstrate continuous residence in the United Kingdom for five years to become eligible for settled status. Continuity was defined with precision: applicants must not have been absent from the UK for more than six months in any rolling twelve-month period, save for a single absence of up to twelve months for an “important reason” such as pregnancy, childbirth, serious illness, study, vocational training, or an overseas posting. Any breach of this rule risked breaking the continuous residence period and could thereby prevent progression to settled status.
This rigid formulation has long drawn criticism from legal practitioners, migrant rights organisations, and the Independent Monitoring Authority (IMA). It has been widely acknowledged that the rule failed to account for the complexity of modern migration patterns and the realities of transnational life. In particular, the COVID-19 pandemic exposed the inherent inflexibility of the rule, with many individuals stranded abroad or forced to prioritise family responsibilities, thus breaching the permitted absence thresholds through no fault of their own.
The 2025 Amendment: A Cumulative Residence Test
Statement of Changes HC 836 responds directly to these challenges. From 16 July 2025, the new rule dispenses with the six-month rolling absence limit and replaces it with a cumulative test: applicants must now demonstrate that they have been physically present in the United Kingdom for at least thirty months out of the most recent sixty-month period. This revised test for continuity will apply to both individuals applying for settled status manually and those automatically upgraded through the Home Office’s automation process, as confirmed in paragraphs 5.15 and 5.16 of the Explanatory Memorandum to HC 836.
Policy Rationale and Treaty Compliance
The policy rationale underpinning this change appears to be twofold. First, it introduces a more flexible and realistic metric of residence, one that better accommodates the varied and often disrupted patterns of movement experienced by many EUSS participants. Second, it ensures greater compliance with the United Kingdom’s obligations under the Withdrawal Agreement, which guarantees residence rights to qualifying EU citizens and their family members and prohibits overly restrictive conditions that might undermine those rights.
Implications for Applicants
The shift to a cumulative presence model will have profound implications. It will allow applicants who were previously ineligible due to absences to re-enter the settlement pathway. For example, an applicant who spent two years outside the UK caring for a relative abroad, but who was otherwise resident in the UK for three years, would now meet the thirty-month threshold and become eligible for settled status. Similarly, individuals who work in industries requiring periods of travel or cross-border flexibility will benefit from this more accommodating approach.
Crucially, this change also reopens the door for those who were refused settled status solely on the grounds of absences. Depending on their circumstances, these individuals may now be able to request a reconsideration, submit a fresh application, or pursue an appeal if still within time. It is likely that this revision will lead to a wave of renewed applications and queries, particularly among applicants who were previously deemed non-compliant with the continuous residence requirement.
Professional Considerations and Evidentiary Strategies
For legal advisers and regulated representatives, this amendment invites a thorough reappraisal of client eligibility. Practitioners should now assess not only whether a client’s absences breached the prior six-month rule, but whether the total time physically spent in the UK within the last five years meets or exceeds the thirty-month threshold. This may require collation and cross-referencing of documents such as bank statements, tenancy agreements, utility bills, employment records, and NHS correspondence to evidence presence in the UK.
Reception by the Legal and Oversight Community
The Independent Monitoring Authority, which previously initiated legal action against the Home Office for non-compliance with the Withdrawal Agreement, has welcomed the change. It described the amendment as an important step towards ensuring the scheme functions in a fair and proportionate manner. Legal commentators, including those at Free Movement, have similarly noted that this simplification of the permitted absences rule brings much-needed clarity to an area of law that was often misunderstood by applicants and misapplied by caseworkers.
Wider Implications and Policy Direction
Although the change is specific to the EU Settlement Scheme, it may also prompt broader reflection on the concept of continuous residence across other parts of the Immigration Rules. The introduction of cumulative presence as a measure—rather than a rigid rolling absence test—marks a notable shift in Home Office thinking. It arguably reflects an evolving approach to immigration policy: one that recognises and accommodates the increasingly fluid, international lives led by migrants.
Conclusion
At Quastels, we are already advising clients on how these changes may impact their immigration position. Our team is available to assist with eligibility assessments, applications for settled status, and challenges to previous refusals. We welcome this development as a measured, legally sound, and human-centred reform that will bring the EUSS back in line with its original purpose: to safeguard the rights of those who built their lives in the United Kingdom before Brexit.
Sources and Citations:
- Home Office, Statement of Changes HC 836 (24 June 2025)
- Home Office, Explanatory Memorandum to HC 836, Paragraphs 5.15–5.16
- Independent Monitoring Authority (IMA) Press Release, June 2025
- Free Movement: “Statement of Changes HC 836 sees changes to permitted absences for EU Settlement Scheme” (24 June 2025)
- Appendix EU to the Immigration Rules, as amended