The Data (Use and Access) Act 2025 (DUAA) introduces several significant changes to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). Here’s a summary of how these changes affect Registered Social Landlords (RSLs) and housing associations in the UK, along with examples of affected areas:

Key Changes and Their Impact

  1. Lawfulness of Processing (Section 70; Schedule 4)
    • New Lawful Grounds: The DUAA introduces new lawful grounds for processing personal data, particularly for non-public bodies. This includes processing necessary for crime prevention, safeguarding vulnerable people, and responding to emergencies.
    • Impact on RSLs: Housing associations can process personal data without the need for a detailed legitimate interests assessment in specific situations, such as safeguarding tenants or preventing fraud.
  2. Purpose Limitation (Section 71)
    • Clarified Re-use of Data: The Act clarifies when further processing or re-use of personal data is compatible with the original purpose, including for crime prevention.
    • Impact on RSLs: RSLs can re-use tenant data for new purposes like crime prevention or emergency responses, provided they meet the lawful ground requirements.
  3. Data Subjects’ Rights (Sections 75-78; Section 104)
    • Subject Access Requests (SARs): The Act introduces a “stop the clock” provision for SARs, allowing organisations to pause the response time if they need more information from the data subject.
    • Impact on RSLs: Housing associations can manage SARs more effectively, ensuring they have all necessary information before responding, thus reducing administrative burdens.
  4. Automated Decision-Making (Section 80; Schedule 6)
    • Permissive Framework: The Act creates a more permissive framework for automated decision-making, with safeguards such as providing information to data subjects and enabling them to challenge decisions.
    • Impact on RSLs: Housing associations can use automated systems for decisions like tenant eligibility or rent adjustments, provided they implement the required safeguards.
  5. Data Protection by Design: Children’s Higher Protection Matters (Section 81)
    • New Duty for Services Accessed by Children: The Act introduces a duty for services likely to be accessed by children to consider their higher protection needs.
    • Impact on RSLs: Housing associations offering services to families must ensure their data processing activities consider the specific needs and protections required for children.
  6. Transfers of Personal Data to Third Countries (Section 85; Schedules 7-9)
    • New Data Protection Test: The Act introduces a test for data transfers to third countries, ensuring the protection level is “not materially lower” than in the UK.
    • Impact on RSLs: Housing associations transferring tenant data internationally must ensure the receiving country meets the required data protection standards.

Examples of Affected Areas

  • Tenant Safeguarding: RSLs can process data to protect vulnerable tenants without extensive assessments.
  • Crime Prevention: Housing associations can share data with law enforcement for crime prevention.
  • Emergency Responses: Data can be processed quickly in emergencies, such as natural disasters or public health crises.
  • Automated Systems: Use of automated decision-making for tenant services, with necessary safeguards.
  • Children’s Data: Enhanced protections for data related to children in family housing services.
  • International Data Transfers: Ensuring compliance with new standards for data transfers outside the UK.

These changes aim to provide greater clarity, flexibility, and protection in data processing, benefiting both housing associations and their tenants

If you would like to discuss further, please contact us.