The Data (Use and Access) Act 2025: What UK Adult Social Care Providers Need to Know
Written by Keara Bowgen-Nicholas, Senior Associate at RWK Goodman
The Data (Use and Access) Act 2025 (DUAA) is now in effect and has introduced important changes to the UK’s data protection framework. It does not replace the current UK legislation (the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018) but has brought in amendments aimed at making compliance more workable, supporting innovation and enabling responsible data use while maintaining high standards of protection.
Adult social care providers in the UK routinely process large amounts of sensitive information about the people they support and their families, their staff and a number of other individuals. It is essential providers are up to speed on the reforms.
Recognised Legitimate Interests and Information Sharing
One of the key changes is the introduction of “recognised legitimate interests”. In specified circumstances, organisations may process personal data without carrying out a full legitimate interests’ assessment, those circumstances include safeguarding, crime prevention, emergency response and certain public interest purposes.
For adult social care providers, this may assist where information needs to be shared quickly to protect a service user, support safeguarding referrals or to response to some other emergency situation. However, it should not be treated as a blanket permission to share care records. Providers will still need to identify the correct lawful basis, consider confidentiality and capacity issues, and ensure privacy notices and data protection records accurately explain how personal information is used.
Subject Access Requests in Adult Social Care
The DUAA confirms that organisations are only required to carry out searches that are “reasonable and proportionate” when responding to Subject Access Requests (SARs). This reflects existing regulatory guidance but gives the principle firmer statutory footing.
Providers should still approach SARs carefully, especially where records contain third-party information, family comments, information about other residents or staff, safeguarding material or information that may cause serious harm if disclosed. Clear search decisions and exemption assessments should be documented.
Data Protection Complaints
The Act introduces a new requirement for individuals to complain to the data controller before escalating matters to the Information Commissioner. Adult social care providers will therefore need clear and accessible processes for receiving, investigating and responding to data protection complaints.
Many providers already operate internal complaints procedures under care regulations and contractual arrangements, but those procedures may not adequately capture data protection issues. Providers should now review and update their complaints policies to ensure that data protection complaints are identified, escalated and answered within appropriate timescales.
Automated Decision-Making, AI and Digital Care Tools
The DUAA creates a more permissive framework for certain automated decision-making where special category data is not involved, provided appropriate safeguards are in place. Those safeguards include informing individuals, allowing them to challenge significant decisions and enabling human intervention.
Adult social care providers should be cautious. Many operational technologies involve health data, care needs, safeguarding information, location data or other special category information. Any AI tools used in a care setting will require robust governance. Providers should ensure that data protection impact assessments, procurement checks, transparency information, staff training, contractual safeguards and human oversight arrangements are in place before an AI tool is deployed.
Practical Steps for UK Adult Social Care Providers
Adult social care providers should not treat the DUAA as a general relaxation of data protection obligations. The reforms are better viewed as an opportunity to refresh governance arrangements and ensure that data practices support safe, person-centred, integrated and increasingly digital care. Providers should consider:
- Reviewing privacy notices, lawful basis records and special category data conditions for residents, service users, staff and relatives.
- Updating SAR procedures, including guidance on proportionate searches and adult social care-specific exemptions.
- Creating or updating a dedicated data protection complaints process that links with existing care complaints procedures.
- Reviewing information-sharing arrangements with local authorities, NHS bodies, integrated care systems, regulators, deputies, attorneys, families and other providers.
- Checking whether digital care record systems and other IT systems will comply with emerging information standards for health and adult social care in England.
- Assessing AI, automated tools, electronic monitoring and digital care systems before implementation.
- Training managers, care staff, administrators and governance leads on the updated framework.
The message for UK adult social care providers is clear: the DUAA may create greater flexibility in some areas, but it does not reduce the need for careful judgment, transparency and accountability. In a sector where trust, confidentiality, safeguarding and regulatory compliance are central, strong data protection governance remains an essential part of safe and effective care delivery.
The Health and Social Care Team at RWK Goodman provides support to care providers with all aspects of data compliance.
