Date: January 5, 2026
Guidance for General Practices: Data Use and Access Act 2025 (DUAA)
An update by the Information Commissioner’s Office (ICO) on 19 June 2025 (focusing on what the revised legislation means for regulated organisations) has been used to inform this guidance document for LMCs. The ICO update can be found here.
Overview
The DUAA updates existing laws on digital information, data protection and data use across public and private sectors. It aims to:
- promote innovation, research and digital development
- simplify data protection requirements
- maintain patient rights and confidentiality
Changes apply gradually from June 2025 to June 2026 and mainly streamline current processes.
What laws does the DUAA change?
The DUAA amends, but does not replace:
- UK General Data Protection Regulation (GDPR)
- Data Protection Act 2018 (DPA)
- Privacy and Electronic Communications Regulations (PECR)
General practice information governance (IG) policies remain in place, but some processes become clearer and easier.