Compliance

The UK's new data rules: what the Data (Use and Access) Act means for your build

Priya Nair·Data Protection Lead·7 min

The Data (Use and Access) Act reshaped parts of the UK data-protection landscape, sitting alongside UK GDPR rather than replacing it. If you build software that touches personal data — and almost everyone does — it's worth understanding in practical terms.

This isn't legal advice. It's how we're adjusting the way we build, and how we'd suggest you sense-check your own product with your DPO.

What actually changes for builders

The headline themes are smart-data and data-sharing frameworks, clearer rules around automated decision-making, and modernised expectations for how organisations handle requests and cookies. The direction of travel is pragmatic — but "pragmatic" still means you have to design for it.

  • Automated decisions that materially affect people need meaningful safeguards and a route to human review. If you're shipping AI-driven decisioning, build that in from day one.
  • Subject access and data-portability requests should be an engineered feature, not a scramble in a spreadsheet.
  • Cookie and consent handling is under continued scrutiny — default to the privacy-preserving option and make consent genuinely informed.

    • Design for it, don't bolt it on

    Every principle here is cheaper to build in than to retrofit. On our projects that means data minimisation by default, a documented lawful basis per data flow, encryption in transit and at rest, and audit logging that can actually answer "who saw what, when."

    The practical checklist

  • Know every place personal data enters, rests and leaves your system — and write it down.
  • Make access, export and deletion requests a supported product path, not a manual favour.
  • Keep a human in the loop for consequential automated decisions.
  • Review consent flows against the current ICO guidance rather than a template from three years ago.

    • None of this is exotic. It's secure-by-design and privacy-by-design — the same engineering discipline that makes software trustworthy regardless of which acronym is in force this year.

    Ready when you are

    Let's build something that lasts.

    Book a free 30-minute call with a senior engineer. No sales pitch — just an honest view on whether we're a fit.

    Book a 30-min callSee our work