How the DUAA Act impacts you

Simplified Direct Marketing Rules
Direct marketing, like sending newsletters, is now a “legitimate interest” under the UK GDPR, with a balancing test required. You benefit from relaxed “soft opt-in” rules, allowing electronic marketing to members without explicit consent, provided an opt-out is included.

What it means for you: Update marketing policies, ensure clear opt-outs, and comply with PECR to avoid fines.

Cookies Without Consent
Cookies for analytics and content optimisation can be used without consent in low-risk cases, if an opt-out is provided.

What it means for you: Update website cookie banners to include opt-outs and revise cookie policies.

Data Subject Access Requests (DSARs)
A “stop the clock” rule pauses the one-month DSAR response deadline if clarification is needed. Searches must be “reasonable and proportionate.”

What it means for you: Update DSAR procedures to use the new rule and align searches with the standard.

Mandatory Complaints Process
Organisations must have a formal data protection complaints process, including an electronic form, with complaints acknowledged within 30 days.

What it means for you: Set up an online complaints form and train staff to respond promptly.

Stronger ICO Enforcement
The ICO gains powers to compel interviews, request reports, and issue fines up to £17.5m or 4% of turnover under PECR.

What it means for you: Prioritise compliance, especially for marketing and cookies, to avoid penalties.