Last updated: October 2026. Reviewed by the BespokeCRMs team, subject matter experts in Customer Relationship Management (CRM) systems for regulated UK businesses. Sources: the Data (Use and Access) Act 2025 and its commencement regulations on legislation.gov.uk, GOV.UK guidance and factsheets, and Information Commissioner's Office (ICO) guidance and announcements. Full citations appear at the end of this article. Part of our CRM Technology and Trends series.
TL;DR: The Data (Use and Access) Act 2025 amends UK data protection law rather than replacing it. Most of its data protection changes took effect on 5 February 2026, with a new complaints duty from 19 June 2026. For a CRM, the changes that matter most are a new lawful basis, wider automated decision-making with safeguards, and a complaints workflow.
If you have read our CRM and GDPR compliance guide, you already have the grounding this article builds on. This is the companion update: what the Data (Use and Access) Act 2025 (DUAA) changed in 2026, and what each change means for the way your CRM is designed and configured. It is not another general explainer. It is about the fields, workflows and audit trails inside your database.
What the Data (Use and Access) Act 2025 changed, and when
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025.[1] It does not replace the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 or the Privacy and Electronic Communications Regulations (PECR). Instead it amends them, adjusting areas such as lawful bases, automated decision-making, complaints, subject access, cookies and international transfers.[2]
The Act does not commence on a single date. Many of its provisions are switched on in stages by commencement regulations.[3] Two dates matter for most businesses. The main tranche of data protection changes came into force on 5 February 2026, covering recognised legitimate interests, automated decision-making, cookies, direct marketing and international transfers.[4][5] A separate duty on handling data protection complaints came into force on 19 June 2026.[4] Both dates have passed, so these are live obligations, not future ones. A later change to the regulator's own structure is covered towards the end of this article.
Here is the shape of the change at a glance, before we work through what each item means for your CRM.
| Area | Before the Act | After the Act |
|---|---|---|
| Lawful bases | Six lawful bases; ordinary legitimate interests needs a balancing test | A seventh basis, recognised legitimate interests, with no balancing test for five listed public-interest purposes |
| Solely automated significant decisions | Restricted to three exceptions: contract, law or explicit consent | Permitted more widely with at least four safeguards; restrictions remain for special category data and recognised legitimate interests |
| Data protection complaints | No statutory complaints-handling duty on organisations; individuals could complain to the ICO | Organisations must facilitate complaints, acknowledge them within 30 days and respond without undue delay; complaints to the ICO remain available |
| PECR maximum fine | £500,000 | £17.5 million or 4% of worldwide turnover, whichever is higher, for breaches of the core rules |
| International transfer test | Level of protection "not undermined" | Standard of protection "not materially lower" |
Recognised legitimate interests: a new lawful basis to add to your CRM
Recognised legitimate interest is a new lawful basis, inserted into Article 6(1) of the UK GDPR as point (ea).[6] The ICO now describes it as one of the seven lawful bases, alongside consent, contract, legal obligation, vital interests, public task and ordinary legitimate interests.[7] It applies to a short, closed list of public-interest purposes that the law has pre-approved.
The ICO describes it plainly:
"A 'recognised legitimate interest' is a specified purpose for handling personal information that is in the public interest. These pre-approved purposes are in annex 1 of the UK GDPR and are the recognised legitimate interest conditions."[7]
There are currently five conditions: disclosing data to another organisation that needs it for a public task, safeguarding national security, public security or defence, responding to an emergency, preventing, detecting or investigating crime, and safeguarding vulnerable individuals.[7] Other paragraphs in the annex are definitions that support these five, not additional grounds.[8] The Secretary of State can amend the list by regulations, so it is worth checking the current annex rather than hard-coding it for ever.[6]
The mechanism is the important part. Recognised legitimate interest removes the balancing test only, and the necessity test still applies.
"There is still a necessity test, but there is no requirement for an organisation to carry out an additional balancing test to balance the benefits of this processing against the impact on the rights and freedom of the people whose personal information it is using."[9]
Two limits are worth building into any CRM. Public authorities cannot rely on this basis for performing their tasks, and it cannot be used to make a significant decision about someone based solely on automated processing.[7][10] People can also object to processing that relies on it, because the Act extends the right to object in Article 21(1) to the new basis.[6]
What this means for your CRM. If your system currently forces every non-consent purpose into a single "legitimate interests" field with a mandatory balancing-test note, it now needs a distinct, selectable "recognised legitimate interest" option tagged to one of the listed conditions. The necessity justification should still be captured, but a balancing-test narrative is not required for these purposes, and demanding one recreates work the law has already done.[7] Records on this basis should also be able to carry an objection flag, and the CRM should block them from feeding any solely automated significant decision.
Automated decisions and AI features: looser rules, mandatory safeguards
Section 80 of the Act replaces the old Article 22 of the UK GDPR with new Articles 22A to 22D governing automated decision-making.[10] A decision is "based solely on automated processing" where there is no meaningful human involvement in taking it, and it is "significant" where it produces a legal effect, or a similarly significant effect, for the person.[10]
Before the Act, a person had the right not to be subject to a solely automated significant decision unless the decision was necessary for a contract, required or authorised by law with suitable safeguards, or based on their explicit consent.[11] The Act changes that position.
"This section removes these restrictions. It allows an organisation to make solely automated decisions in a wider range of situations as long as it has appropriate safeguards in place."[9]
The government describes the result as "a more permissive framework under the UK GDPR for organisations to make decisions based solely on automated processing".[2] For CRM lead scoring and approval workflows, the ICO's summary is the key point: the change has the effect of "potentially" allowing an organisation "to rely on any of the lawful bases, apart from the new recognised legitimate interests basis, when it makes significant automated decisions about people".[9] That includes ordinary legitimate interests, which was not one of the three routes available before.[11]
The trade-off is a set of mandatory safeguards. Where a significant decision is based solely on automated processing, the safeguards must consist of or include measures that give the person information about decisions taken about them, enable them to make representations, enable them to obtain human intervention, and enable them to contest the decision.[10] That is at least four safeguards, and the Secretary of State can add to them by regulations.[10] A CRM that runs automated decisions has to be able to deliver all of them.
Special category data is treated differently. A significant decision based entirely or partly on special category data, such as health, biometric or ethnicity information, still cannot be taken solely by automated means unless the person has given explicit consent, or the decision is necessary for a contract or required or authorised by law and the substantial public interest condition in Article 9(2)(g) applies.[10][9] Decisions taken before 5 February 2026 under the old safeguards stay under the old rules.[4]
One caveat to design around: at the time of writing, the ICO is still finalising its updated guidance on automated decision-making and profiling. It consulted on a draft between 31 March and 29 May 2026,[12] and its guidance pipeline lists the final version as due in winter 2026.[13] The Act also lets the Secretary of State make regulations on what does, or does not, count as meaningful human involvement.[10] The statutory rules are in force; the detailed interpretation is still developing.
What this means for your CRM. A CRM that auto-scores leads, auto-approves or declines applications, or auto-prices quotes in a way that significantly affects someone now has a wider legal route to run those decisions automatically. To use it safely, the system needs to record which lawful basis and safeguards apply, route a "contest this decision" action to a real person through an actionable human-review queue, and block solely automated decisions on special category data unless a valid condition is met. Because the regulator's guidance is still being finalised, building a genuine review queue now is more prudent than waiting for it. This matters most in sectors like financial services and recruitment, where automated scoring and screening are common.
The new complaints duty your CRM has to support
From 19 June 2026, people can complain directly to an organisation if they think its handling of their personal data infringes the UK GDPR, and the organisation must deal with that complaint.[14] The Act inserts a new section 164A into the Data Protection Act 2018, which requires a controller to facilitate complaints "by taking steps such as providing a complaint form which can be completed electronically and by other means".[14]
"New legal requirements on how organisations handle data protection complaints are now in force, marking a significant change for businesses across the UK."[15]
Two mechanics are concrete. A controller must acknowledge receipt of a complaint within 30 days of receiving it, and must then, without undue delay, take appropriate steps to respond and tell the complainant the outcome.[14] The ICO deliberately declines to set a fixed resolution deadline:
"The important thing is to consider all the circumstances of the complaint, not to apply a set period of time as a blanket approach."[16]
The ICO also says organisations should keep a record of the date each complaint was received, the acknowledgement, relevant conversations and documents, the outcome and any actions taken as a result.[16] That record is the difference between an auditable process and an assertion. The duty applies only to complaints received on or after 19 June 2026, so there is no need to backfill older matters.[4]
The same commencement changed what you tell people. Privacy notices and subject access responses must now mention the right to complain to the organisation, alongside the right to complain to the ICO.[17]
What this means for your CRM. This is a buildable feature, not just a policy. Your CRM, or the portal that feeds it, should offer a clear intake route for data protection complaints that is distinct from a general support ticket, and the law's own example is a complaint form that can be completed electronically and by other means.[14] The record should timestamp receipt so the 30-day acknowledgement is auditable, and carry status, progress and outcome fields to close the loop. Folding these into ordinary customer-service tickets is risky, because a data protection complaint carries its own statutory clock. If your CRM generates privacy notices or subject access response packs from templates, those templates also need the new wording.
Subject access requests: stop-the-clock and reasonable search, now in law
The Act puts two familiar subject access request (SAR) practices onto an explicit statutory footing. First, a person is entitled only to the information a controller can provide "based on a reasonable and proportionate search".[18] This provision came into force at Royal Assent and is treated as having been in force since 1 January 2024.[18]
Second, the Act formalises "stopping the clock", with effect from 5 February 2026. Where a controller reasonably requires further information to identify the information or processing a request relates to, it may ask for it, and the period between asking and receiving the reply does not count towards the response deadline.[19][4] The ICO says clarification should not be requested "on a blanket basis", only where it is reasonably required, and that the time limit resumes on the day after the clarification is received.[20]
What this means for your CRM. Two small build items follow. A SAR record needs a genuine "clock paused" state that actually stops the timer and resumes when the requester replies, not a note reminding a human to remember, together with a record of why clarification was reasonably required. And because the search standard is now a defensibility test, a CRM's SAR export should log what was searched, which modules and archives, so the business can show the search was reasonable and proportionate if it is ever challenged.
Cookies, marketing and a much larger fine
The Act reforms PECR in three ways that touch a CRM's web forms and marketing. First, it adds exceptions so that some low-risk cookies and similar technologies no longer need prior consent: collecting statistical information to improve a service or website, adapting a website's appearance or functions to a user's preferences, and locating a user who has asked for, or appears to need, emergency assistance.[21] The first two still require clear and comprehensive information and a simple, free way to object. The statistics exception also applies only if the information is not shared with anyone else except to help make those improvements.[21]
Second, it gives charities a soft opt-in for electronic marketing. A charity may send electronic mail marketing whose sole purpose is to further its charitable purposes to people whose details it obtained when they expressed an interest in, or offered or provided support to, those purposes, provided the person is given a simple means of refusing, free of charge apart from transmission costs, both when the details are collected and in every subsequent message.[22] The ICO is explicit: "Only charities can use the charitable purposes soft opt-in."[23] PECR uses the legal definition of a charity in each UK nation, so a non-profit or social enterprise that is not a charity cannot rely on it.[22][23] The ICO adds that it applies only to contact details obtained on or after 5 February 2026, and only where the charity obtained them directly, not through a trading subsidiary or other connected organisation.[23] If you run marketing for a charity, this needs its own permission status in the CRM, kept separate from consent; our guide to CRM for UK charities covers the wider donor-data picture.
Third, the maximum PECR fine has risen sharply. Before the Act, PECR penalties were capped at £500,000.[24][25] PECR penalties now follow the Data Protection Act 2018: the higher maximum of £17.5 million or 4% of total annual worldwide turnover, whichever is higher, applies to breaches of the core rules, including the cookie rule in regulation 6 and the marketing rules in regulations 19 to 24, and other breaches carry the standard maximum of £8.7 million or 2%.[26][27] The ICO confirms it can now issue PECR fines of up to £17.5 million or 4% of global turnover,[5] and describes the change as bringing PECR enforcement into line with UK GDPR, "so that enforcement mechanisms and penalties are the same in most cases".[28]
What this means for your CRM. Revisit how the CRM's own web forms and tracking treat cookies, so that analytics and preference cookies that genuinely meet the new conditions are not needlessly gated behind a consent banner, and so that those that do not meet them still are. If you serve charity clients, add a distinct soft opt-in status that records when, how and by which entity the contact details were collected, with the opt-out re-offered on every send. And treat consent and permission accuracy as a higher-stakes feature than before, because the ceiling for getting it wrong is now measured in millions.
International data transfers: a new name for the test
If your CRM, or a tool connected to it, is hosted outside the UK, the transfer test has changed shape. The Act removes the old general principle that transfers must not undermine the level of protection guaranteed by the UK GDPR, and replaces it with a new data protection test: a transfer is allowed where the standard of protection would be "not materially lower" than under UK law.[29][30] The government's factsheet adds that controllers and processors must act "reasonably and proportionately" when deciding whether the test is met.[31]
What this means for your CRM. A CRM hosted abroad, or integrated with an overseas email platform, enrichment service or support tool, now sits under the "not materially lower" standard. Whether that changes the outcome for a particular transfer is a question for your legal advisers, but it is an explicit test to document your reasoning against. It is worth revisiting during any CRM integration work that moves personal data outside the UK.
A note on the regulator itself
The Act also restructures the regulator. Commencement regulations made on 10 September 2026 abolish the office of Information Commissioner and transfer its functions to a new body corporate, the Information Commission, from 30 September 2026.[32] The same regulations carry over anything already done, or in the process of being done, by or in relation to the Commissioner, so existing work continues.[32] The ICO has confirmed that the change maintains its existing regulatory functions and responsibilities, and that "As the Information Commission's Office, we will continue to be known as the ICO."[33] For your CRM, nothing changes in practice, although templates that name the regulator, such as privacy notices and complaint acknowledgements, may be worth a wording check.
What to configure in your CRM now
The practical work maps cleanly onto the changes above. This table is a useful starting point for a configuration review or a build brief.
| DUAA change | In force | What to configure in your CRM |
|---|---|---|
| Recognised legitimate interests | 5 February 2026 | A selectable lawful basis tagged to one of the listed conditions, with a necessity note, no balancing test and an objection flag |
| Automated decision-making | 5 February 2026 | Safeguard logging, a human-review queue for "contest" actions, and a block on special category and recognised-legitimate-interest auto-decisions |
| Complaints handling | 19 June 2026 | A distinct complaint intake, a receipt timestamp, a 30-day acknowledgement, status and outcome fields, and updated privacy notice and SAR templates |
| Subject access requests | Stop the clock: 5 February 2026. Reasonable and proportionate search: treated as in force from 1 January 2024 | A "clock paused" state on SARs, and a log of what was searched |
| Cookies and charity marketing | 5 February 2026 | Cookie categories reflecting the new exceptions, and a charity soft opt-in status with collection date and source where relevant |
| International transfers | 5 February 2026 | Documented "not materially lower" reasoning for any non-UK hosting or integration |
| Regulator | 30 September 2026 | A wording check on templates that name the regulator |
Where a bespoke build helps, and where it does not
Honesty matters here, and off-the-shelf is often the right answer. Mainstream CRM platforms may absorb some of this through their own updates, and for standard marketing and sales workflows a well-configured off-the-shelf system is usually enough. The DUAA changes are not, by themselves, a reason to commission a custom build.
Where a bespoke system earns its place is when compliance has to be a property of the software rather than of staff discipline. If you need recognised-legitimate-interest tagging, an auditable automated-decision safeguard trail, a complaints workflow with its own statutory clock, and SAR search logging to all behave correctly by default, and your existing platform cannot be configured to do so, that integrated, auditable record is exactly what a bespoke CRM development project is for. If you are unsure which side of that line you sit on, an honest CRM consultation will tell you plainly.
An illustrative scenario
Consider a hypothetical example. A mid-sized UK lender uses its CRM to decline credit applications automatically below a risk score, with no structured way for an applicant to challenge the outcome. Under the new Articles 22A to 22D, the lender has a wider legal route to keep the automation, but only with the safeguards in place: telling applicants about the automated decision, letting them make representations, giving them a route to human intervention, and letting them contest the outcome.[10] In CRM terms, that means a notice generated with each automated decision, a "request a review" action, and a queue that puts contested cases in front of an underwriter within a set internal timescale.
The same review would look for a second gap. If the support team logs data protection complaints as ordinary tickets, with no receipt timestamp and no 30-day acknowledgement, the lender cannot show it is meeting the complaints duty.[14] Splitting data protection complaints into their own workflow, with an auditable clock, closes the gap. Neither fix requires a new platform; both require the CRM to treat a legal obligation as a first-class feature rather than a manual habit. For regulated lenders and advisers, this is the same discipline we describe in our guide to CRM for UK financial advisers.
Frequently asked questions
When did the Data (Use and Access) Act 2025 come into force?
The Act received Royal Assent on 19 June 2025 and commences in stages. The main data protection changes, including recognised legitimate interests, automated decision-making and the PECR reforms, came into force on 5 February 2026. A separate duty to handle data protection complaints came into force on 19 June 2026. Both dates have now passed.[1][4]
Does the Data (Use and Access) Act replace UK GDPR?
No. The Act amends the UK GDPR, the Data Protection Act 2018 and PECR rather than replacing them. It edits specific areas such as lawful bases, automated decisions, subject access, complaints, cookies and international transfers. The core structure of UK data protection law, including the lawful bases and the data protection principles, remains in place.[2]
What is a recognised legitimate interest?
A recognised legitimate interest is a new lawful basis in the UK GDPR for a short list of pre-approved public-interest purposes: certain disclosures for public tasks, national security and defence, emergencies, crime, and safeguarding vulnerable individuals. Unlike ordinary legitimate interests, it does not require a balancing test, although a necessity test still applies.[7][9]
Can a CRM make automated decisions under the new rules?
Yes, more readily than before. Organisations can now make solely automated decisions with legal or similarly significant effects in a wider range of situations, provided safeguards are in place: information about the decision, the ability to make representations, human intervention, and a route to contest it. Special category data and recognised legitimate interests remain restricted.[10]
What do the new data protection complaint rules require?
From 19 June 2026, organisations must let individuals complain to them directly about data protection and must facilitate this, for example with a complaint form that can be completed electronically. A complaint must be acknowledged within 30 days and responded to without undue delay. The ICO expects a case-by-case approach rather than a fixed resolution period.[14][16]
Did the fines for marketing and cookie breaches change?
Yes. The maximum penalty under PECR rose from £500,000 to £17.5 million or 4% of total annual worldwide turnover, whichever is higher, for breaches of the core rules, including cookies and electronic marketing. Other breaches carry a standard maximum of £8.7 million or 2%. This brings PECR penalties into line with UK GDPR in most cases.[26][28]
Is the ICO becoming the Information Commission?
Yes. Commencement regulations made on 10 September 2026 abolish the office of Information Commissioner and transfer its functions to a new body corporate, the Information Commission, from 30 September 2026. The regulator has confirmed that it will continue to be known as the ICO, now standing for the Information Commission's Office, with its regulatory functions unchanged.[32][33]
Getting your CRM ready
The Data (Use and Access) Act 2025 does not tear up UK data protection law, but it moves enough of the detail that a compliance-aware CRM needs revisiting. The changes that matter most, a new lawful basis, a permissive-but-safeguarded automated-decision regime, and a complaints workflow with its own clock, are all things your system should handle by design rather than by memory.
If you want an honest assessment of whether your current CRM can be configured to meet these obligations, or whether a tailored build would serve you better, talk to our team. We design, build and maintain bespoke CRM systems for regulated UK businesses, and we will tell you plainly when off-the-shelf is the better choice. Book a discovery call to review what the 2026 reforms mean for your CRM. For the wider grounding, read our companion CRM and GDPR compliance guide.
The information in this article is general guidance on UK regulation at the time of writing. It is not legal advice, and it is not a substitute for advice specific to your organisation. Data protection law is complex and still evolving, and at the time of writing the ICO is still finalising its guidance on some of these changes, including automated decision-making. Consult a qualified data protection adviser, and check the current text on legislation.gov.uk and ico.org.uk, before making decisions with compliance implications.
Sources
Each source below was checked against the claim it supports before publication.
- legislation.gov.uk, Data (Use and Access) Act 2025 (2025 c. 18, Royal Assent 19 June 2025).
- GOV.UK, Data (Use and Access) Act 2025: data protection and privacy changes (published 27 June 2025).
- GOV.UK, Data (Use and Access) Act 2025: plans for commencement (first published 25 July 2025).
- legislation.gov.uk, The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82) (made 29 January 2026), regulations 2, 3, 5 and 7.
- ICO, Statement on the commencement of the Data (Use and Access) Act (DUAA) (5 February 2026).
- legislation.gov.uk, Data (Use and Access) Act 2025, section 70 (lawfulness of processing).
- ICO, Recognised legitimate interest (published 23 March 2026).
- legislation.gov.uk, Data (Use and Access) Act 2025, Schedule 4 (recognised legitimate interests).
- ICO, The Data (Use and Access) Act 2025 (DUAA): summary of the changes, data protection (published 19 June 2025, updated 20 August 2025).
- legislation.gov.uk, Data (Use and Access) Act 2025, section 80 (automated decision-making), inserting Articles 22A to 22D of the UK GDPR.
- legislation.gov.uk, UK GDPR, Article 22 (automated individual decision-making), point-in-time version as at 4 February 2026.
- ICO, ICO consultation on the draft guidance about automated decision-making, including profiling (31 March to 29 May 2026).
- ICO, Our plans for new and updated guidance: technology (living page; status as at the time of writing).
- legislation.gov.uk, Data (Use and Access) Act 2025, section 103 (complaints by data subjects), inserting section 164A of the Data Protection Act 2018.
- ICO, New data protection complaints law now in force (23 June 2026).
- ICO, How to deal with data protection complaints: what do we do when we receive a complaint? (published 12 February 2026).
- legislation.gov.uk, Data (Use and Access) Act 2025, Schedule 10 (complaints: minor and consequential amendments), paragraphs 3 to 5.
- legislation.gov.uk, Data (Use and Access) Act 2025, section 78 (searches in response to data subjects' requests).
- legislation.gov.uk, Data (Use and Access) Act 2025, section 76 (time limits for responding to data subjects' requests), inserting Article 12A of the UK GDPR.
- ICO, Right of access: what should we consider when responding to a request? (updated 8 December 2025).
- legislation.gov.uk, Data (Use and Access) Act 2025, Schedule 12 (storing information in the terminal equipment of a subscriber or user), inserting Schedule A1 to PECR.
- legislation.gov.uk, Data (Use and Access) Act 2025, section 114 (use of electronic mail for direct marketing by charities).
- ICO, Guidance on direct marketing using electronic mail: how do we comply with the PECR electronic mail marketing rules? (guidance updated 28 April 2026).
- legislation.gov.uk, The Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010, regulation 2.
- legislation.gov.uk, The Privacy and Electronic Communications (EC Directive) Regulations 2003, Schedule 1, point-in-time version as at 4 February 2026, paragraph 12.
- legislation.gov.uk, Data Protection Act 2018, section 157 (maximum amount of penalty).
- legislation.gov.uk, Data (Use and Access) Act 2025, Schedule 13 (privacy and electronic communications: Commissioner's enforcement powers), paragraph 18.
- ICO, The Data (Use and Access) Act 2025 (DUAA): summary of the changes, privacy and electronic communications (published 19 June 2025).
- legislation.gov.uk, Data (Use and Access) Act 2025, Schedule 7 (transfers of personal data to third countries etc: general processing).
- legislation.gov.uk, UK GDPR, Article 44 (general principle for transfers), point-in-time version as at 4 February 2026.
- GOV.UK, Data (Use and Access) Act factsheet: UK GDPR and DPA (published 27 June 2025).
- legislation.gov.uk, The Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/1015) (made 10 September 2026), regulations 2 and 3.
- ICO, ICO governance changes confirmed for 30 September 2026 (15 September 2026, updated 17 September 2026).