The Data (Use and Access) Act 2025 received Royal Assent in June 2025 and is being brought into force in stages. It amends UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations. For most small and medium businesses, it is an update rather than a rewrite. Some changes do matter, particularly around AI and automated decision-making.
What has stayed the same
The fundamentals have not moved. You still need a lawful basis for processing personal data. You must still keep it secure. You must still not keep it for longer than you need it. The storage limitation and security principles, which are the ones that make secure shredding a legal necessity, remain firmly in place.
Key changes to be aware of
Automated decision-making and AI
The Act relaxes some restrictions on decisions made solely by automated means, including AI systems, where special category data is not involved. It does not remove protections. Organisations must still provide safeguards, such as telling people about significant decisions, letting them make representations, and offering human review. If you use AI to screen job applicants, assess credit or prioritise customers, review your processes against the updated rules.
Subject access requests
The Act confirms that organisations need only carry out reasonable and proportionate searches when responding to a subject access request. That only helps if your records are well organised. Overflowing archive boxes of old paperwork make every request harder, and every extra year you keep data you do not need is another year it could be requested or exposed.
Complaints handling
Organisations are expected to have a process for handling data protection complaints from individuals. A clear retention and destruction policy, backed up by Certificates of Destruction, makes it much easier to answer questions about what happened to someone's data.
Recognised legitimate interests
The Act introduces a list of recognised legitimate interests, such as crime prevention and safeguarding, which simplifies some processing decisions. It does not change your duty to destroy data once that purpose has been served.
What this means for your paper records
Because the law is changing in stages, now is a good time for a records review:
- Update your retention schedule. List what records you hold, why, and how long each type must be kept. HMRC, employment and sector rules often set minimum periods.
- Identify what is past its date. Old payroll, expired contracts, former employee files and historic customer records are common culprits.
- Destroy it securely and keep proof. A Certificate of Destruction records the date and method, which supports your accountability obligations.
- Do not forget devices. Old PCs, laptops and drives that held these records need destroying too, not just wiping.
Keep an eye on official guidance
The ICO is publishing updated guidance as each part of the Act takes effect. If you are unsure how a specific change applies to you, check the ICO website or take professional advice. This article is a general overview, not legal advice.
Make destruction the easy part
North East Shredding Service helps businesses across the North East stay on the right side of data protection law. We provide locked consoles with regular collections, one-off archive clear-outs, on-site shredding at your premises, and hard drive destruction, all with a Certificate of Destruction.
Call 0333 360 8269 or get a free quote today.