The Data (Use and Access) Act 2025 (DUAA)

What the DUAA means for organisations

The Data (Use and Access) Act 2025 updates some laws about digital information.  

The Act changes data protection laws to support innovation and economic growth, while continuing to protect people and their rights.

Most of the changes give organisations the opportunity to work differently, rather than requiring them to make specific changes to comply with the law.

The changes are being introduced in phases between June 2025 and June 2026. 

One significant change for Reading Borough Council is that, from 19 June 2026, we must have a process in place for handling complaints about data protection.

Complaints about the use of personal information

The Act gives people the right to complain to organisations, including local authorities, if they believe their personal information has been used in a way that does not comply with the law.

Organisations and competent authorities must help people make complaints. This includes providing ways for people to submit complaints electronically.

Organisations must acknowledge complaints within 30 days and tell the complainant the outcome without undue delay. They must also take appropriate steps while investigating the complaint, such as making enquiries and keeping the complainant informed of progress.

Reading Borough Council already manages data protection concerns through its corporate complaints process. The main change is that the law now requires complaints to be acknowledged within 30 days.

We will continue to respond in line with our Corporate Complaints Policy within 20 working days. Complaints about data protection matters will be considered at stage 1 only. Complainants will then be directed to the Information Commissioner’s Office (ICO) in accordance with the DUAA.

DUAA complaints process summary

If a complaint is covered by the DUAA, the Reading Borough Council will:

• investigate within 20 working days (stage 1 only)
• extend the investigation by up to 10 working days if necessary (maximum of 30 working days total)
• respond to the complainant and explain their right to contact the Information Commissioner’s Office (ICO)
• close and document the complaint within 1 working day