28 January 2025

What in the world is going on with privacy law in the UK right now?

regulatory updates

Yes, we’re confused too, so we’re taking a moment to make sense of it all.

The backstory: three bills, one big question mark

Over the past couple of years, the UK has introduced three major legislative proposals related to data protection and digital information.

Let’s break it down:

Data Protection and Digital Information (DPDI) Bill

Introduction: First introduced during the 2022-23 parliamentary session.
Status: Didn’t make it! The bill stalled when Parliament dissolved on 24 May 2024. It’s officially off the table now.
Focus: The DPDI Bill aimed to tweak existing UK GDPR rules, simplify data compliance, and encourage innovation. But it never got the chance to move forward.

Digital Information and Smart Data (DISD) Bill

Introduction: Announced in the King’s Speech in July 2024 by the Labour government.
Focus: This bill is about boosting economic growth and modernising how we use data. It focuses on making it easier for consumers to share “smart data” between service providers, developing the UK’s digital identity system, and simplifying rules for using data in research. It also aims to improve IT systems in healthcare and make the Information Commissioner’s Office (ICO) more effective by turning it into the “Information Commission.”
Status: Still being debated. Progress updates? We’ll have to wait and see.

Data (Use and Access) (DUA) Bill

Introduction: This bill was introduced to the House of Lords on 23 October 2024.
Focus: The DUA Bill builds on parts of the older DPDI Bill but with a sharper focus on using data for public services like healthcare and law enforcement. It keeps ideas like smart data sharing and digital verification frameworks while tweaking rules to make data protection simpler. Some plans from the DPDI Bill, like narrowing what counts as personal data, were left out to make sure the UK doesn’t lose its EU GDPR adequacy status.
Status: Moving ahead! It had its second reading on 19 November 2024 headed to the Lords’ Committee stage in December 2024. On 20 January 2025, the National Data Guardian (NDG) held a briefing on the DUA Bill to continue championing the responsible use of health and care data. While the Bill primarily focuses on areas outside health and care data, the NDG remains proactive in addressing any potential impacts on these critical sectors. Have a look at the NDG’s briefing here.

Bottom Line:

The DPDI Bill is out, leaving the DISD Bill and the DUA Bill in the spotlight. They both aim to make data laws work better, but their focus areas are quite different. One leans towards business and innovation; the other leans into public services and practical data use.

If you’d like to read more about the Information Commissioner’s statement on the DUA Bill, here’s their press release. And if you want more information on the DUA Bill, we’ve unpacked it more below in our ‘juice’ section dropdown.

Don’t worry, our next blog post will compare DISD and DUA Bills side by side to see what they mean for the future of data governance in the UK.

The important stuff only.

No fluff.

Stay tuned for updates as the Bills move through Parliament, because, let’s face it, it is coming. In the meantime make sure you’re making practical compliance moves.

What should you be doing now?

We wrote about the DISD Bill last year. Check out our blog post from September 2024 here. Our guidance shared in this blog has not changed. Regardless of any new data bills moving forward, you can get moving on having your house in order, and we are here to help!

Our team brings everything together, legal reviews, tech audits, and training, all wrapped into a turnkey plan that works for your business. No one-size-fits-all here; we make sure your data compliance fits naturally into how you already work. It’s GDPR, minus the headache. Ready to get started? Get in touch with us at onwards@lawboxlegal.com or pick up the phone 01865 952 710

Want to know more? Here's the detail...

The Data (Use and Access)

Bill: A little bit more information juice for you!

Key differences between DISD and DUA Bills

What they focus on: The DISD Bill is all about helping businesses and consumers by modernising systems and boosting growth. The DUA Bill is more focused on public interest, like improving healthcare and supporting law enforcement with better data use.
Where they came from: The DUA Bill takes a lot from the DPDI Bill but makes some adjustments, while the DISD Bill takes a broader approach to innovation and modernisation.
What’s missing: The DUA Bill leaves out some ideas from the DPDI Bill, like changing how personal data is defined or easing rules for data requests. The DISD Bill doesn’t focus on these areas, instead sticking to improving infrastructure and systems.

The Data (Use and Access) Bill (DUA Bill), introduced on 23 October 2024, represents the UK Government’s latest attempt to modernise its data protection framework. Below we unpack the main points of the Bill and what these could mean for individuals and organisations. Hint: there’s a bit of everything in here, from banking to underground pipes!

Smart Data Framework

Ever wanted to switch energy providers or find a better bank account without endless paperwork? Enter the DUA Bill’s Smart Data Framework. This aims to:

Expand data sharing: Consumers and businesses can securely share data with authorised third parties (no more screen-scraping nonsense).
Boost competition: Easily compare providers to get the best deals. Think of it as price-comparison sites on steroids.
Future-proof services: Open Banking is already a hit, with over 10 million users. Now imagine this for energy, telecoms, and more.

The Bill hands the Science and Technology Secretary and the Treasury the power to define the who, what, and how of Smart Data schemes. Complaints and dispute mechanisms? They’re in the pipeline too.

Digital Verification Services (DVS)

Hate queuing at the bank with your passport just to open an account? The DVS framework has your back. Focus points include:

Trust Framework: Sets rules and standards for digital identity verification.
Public Register: A transparent list of certified providers.
Trust Mark: Like a seal of approval for compliant services.

It’s designed to make identity checks faster, easier, and safer, whether you’re buying age-restricted goods or starting a new job. Bonus: no more photocopying, scanning and emailing your ID a dozen times.

NHS Information Standards

The NHS: great at saving lives, not so great at sharing patient records. The DUA Bill tackles this by:

Enforcing consistent data-sharing standards for IT providers.
Making healthcare data systems actually talk to each other (finally!).

The goal? Seamless patient care and fewer headaches for healthcare professionals.

Underground Asset Register (NUAR)

If you’ve ever cursed at roadworks, this one’s for you. The NUAR will map out the UK’s underground pipes and cables, aiming to:

Reduce accidents: Fewer diggers hitting water mains (goodbye, unexpected geysers).
Save time and money: Streamline data-sharing from six days to six seconds.
Boost the economy: Expected savings of £400 million a year.

This mandatory register means everyone, from utilities to councils, will finally be on the same page.

Economic Impact

Let’s talk numbers. The DUA Bill is expected to:

Add £10 billion to the UK economy over the next decade.
Create opportunities by expanding Smart Data schemes and improving public services.

Whether you’re a small business or a curious consumer, there’s plenty to look forward to.

Changes to Data Protection Rules

Now for the nitty-gritty. The DUA Bill tweaks the UK GDPR to make it:

Friendlier for researchers: Clearer definitions for scientific research mean fewer roadblocks.
Less annoying for consumers: Analytics cookies won’t need your permission every five minutes.
Stronger for regulation: The ICO gets a makeover, becoming the “Information Commission” with extra powers to investigate and enforce.

Plus, there’s a focus on protecting children’s data and ensuring national security measures are up to scratch.

What’s been dropped?

Not everything made the cut. Key omissions include:

Narrowing the definition of personal data (no dice).
Adding democratic engagement as a legitimate data processing reason.
Simplifying data subject request refusals (it stays as “manifestly unfounded” rather than “vexatious”).

These changes are likely an effort to keep the UK’s EU GDPR adequacy status intact.

In short:

We will be honest, the DUA Bill is rather ambitious but practical. It’s about making data work for everyone, whether that’s by cutting energy bills, reducing NHS admin, or helping road crews avoid hitting power cables. With potential economic boosts and improved public services, this Bill could change how we think about and use data in the UK.