MLex: Off-market trading venues for stocks and bonds may have to pay an extra data tax, as the European Commission seeks to use a new consolidated tape information service to encourage transactions onto more highly regulated and transparent exchanges. Brussels hopes its new data tape service, modeled on the one the US has run for decades, will help smaller investors spot the best prices among the EU’s far flung exchanges—but plans are meeting opposition from the industry and lawmakers.

Law360: pension savers will be able to use the government's standardised login service to prove their identity and access the long-awaited pension dashboards service once it goes live, the Pensions Dashboards Programme (PDP) has announced.

This term is not defined in the CPR. In normal usage it means information that has been organised and categorised for a pre-determined purpose.

Simply, data is information.

Pensions analysis: The Data (Use and Access) Act 2025 (the ‘Act’) introduces a number of changes relevant to data protection requirements, with this article focusing on the key implications for pension schemes. The most significant change from a pensions perspective relates to data subject complaints, which will need to be responded to ‘without undue delay’–a timeframe that is expected to be shorter than a typical deadline under a scheme’s Internal Dispute Resolution Procedure (IDRP). This article was written by Burges Salmon’s Samantha Howell (director-Pensions & Cyber) and Amanda Leiu (senior associate–Data Protection and Technology).

The Data (Use and Access) Act 2025 (DUAA 2025) received Royal Assent on 19 June 2025. It amends parts of the UK General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR), the Data Protection Act 2018 (DPA 2018) and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR 2003), SI 2003/2426. This Practice Note explains the compliance implications for private sector commercial organisations in the UK. DUAA 2025 provides helpful clarification on the UK data protection regime and makes the data protection regime more flexible in a number of areas. If your organisation already complies with UK data protection and ePrivacy law, you will only need to make minor changes to your compliance processes. Which amendments are in force? The table below sets out the implementation timetable: Compliance area Is this in force? Data subject requests Yes—clarification on the searches required to respond to data subject access requests (DSARs) came into force on 19 June 2025 (and are treated as having come into force on 1 January 2024). The

The Data (Use and Access) Act 2025 (DUAA 2025) received Royal Assent on 19 June 2025. It amends parts of Assimilated Regulation (EU) 2016/679, the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018) and the Privacy and Electronic Communications (EC Directive) Regulations 2003, SI 2003/2426. This Practice Note explains the employment-related implications for organisations in the UK, and how the introduction of DUAA 2025 will be phased. DUAA 2025 provides helpful clarification on the UK data protection regime and makes the data protection regime more flexible in a number of areas. If the organisation already complies with UK data protection law, it will only need to make minor changes to its employment processes. For information on data protection issues in employment generally, see Practice Notes: The UK GDPR and DPA 2018: key data protection issues for employment lawyers and The UK GDPR and DPA 2018: lawful processing of personal data in employment. Which amendments are in force? The table below sets out the anticipated implementation timetable:

The Department for Science, Innovation and Technology (DSIT) has announced that the Data Use and Access Act has received Royal Assent. The Act introduces a new data regime designed to enhance NHS efficiency by enabling real‐time access to patient healthcare information across all NHS trusts, GP surgeries and ambulance services, irrespective of the IT system in use. This measure is expected to save NHS staff 140,000 hours of administrative work annually, thereby allowing more time for patient care and speeding up diagnoses and treatments.

This Practice Note tracks key developments relating to the Data (Use and Access) Act 2025 (DUAA 2025) which received Royal Assent on 19 June 2025 and came partly into force on that date (see DUAA 2025, s 142). The majority of the provisions of DUAA 2025 do not come into force until regulations (in the form of statutory instruments) are made for such purpose (see: LNB News 28/07/2025 33). This tracker monitors such developments. This tracker also records the legislative journey of DUAA 2025 prior to Royal Assent (and refers to DUAA 2025 as the DUA Bill or the Bill in such circumstances), including amendments to the DUA Bill as it proceeded through the parliamentary stages, consultations, related guidance and announcements. DUAA 2025 contains seven parts: • Part 1 covers access to customer and business data and aims to enable ‘Smart Data’ to be used in sectors other than its current use in open banking in the finance sector • Part 2 regulates the provision of digital verification services through the creation of a trust framework,

Parliament passed the Data (Use and Access) Bill (DUA Bill) on 11 June 2025. First introduced in October 2024, this passage concludes a protracted legislative process as a notable amount of legislative 'ping pong' (nine rounds of back-and-forth) took place between the two Houses. Central to these discussions was the contentious issue surrounding the use of copyright works in the development of AI systems. During the last debate on 11 June 2025, the House of Lords opted against insisting once more on its amendment, which would have required further government legislation on copyright infringement and transparency in AI. Instead, the peers accepted an amendment in lieu from the Commons, which mandates the Secretary of State for Science, Innovation and Technology to lay a progress statement before Parliament within six months of the DUA Bill’s enactment, outlining advancements on the review. The DUA Bill will now move forward for royal assent at a date yet to be confirmed.

The Data (Use and Access) Bill (DUA) received Royal Assent and became an Act of Parliament on Thursday 19 June 2025. This followed its parliamentary review being finalised on 11 June 2025 and marked the culmination of nearly eight months of parliamentary procedure. Under section 142 of the DUA, most provisions will come into force as and when the Secretary of State appoints regulations. However, a limited number of provisions came into force upon Royal Assent. This included section 78, which relates to reasonable and proportionate searches for data subject access requests. It also included sections 126–128 on the retention of biometric data, and schedule 16 on the grant of energy smart meter communication licences.

The Data (Use and Access) Bill (DUA) is set to receive Royal Assent and become an Act of Parliament on Thursday 19 June 2025. This follows its parliamentary review being finalised on 11 June 2025 and marks the culmination of nearly eight months of parliamentary procedure. Under section 142 of the DUA, most provisions will come into force as and when the Secretary of State appoints regulations. However, a limited number of provisions will come into force upon Royal Assent. This includes section 78, which relates to reasonable and proportionate searches for data subject access requests. It also includes sections 126–128 on the retention of biometric data, and schedule 16 on the grant of energy smart meter communication licences.