An overview of DUAA and changes to how organisations collect, use and manage personal information. These include updates to data protection complaints, electronic marketing rules and website tracking requirements.

What is DUAA 2025?

DUAA is legislation that updates existing data protection rules and introduces changes across several areas of data use.

For organisations, this means reviewing how personal information is handled across everyday activities, including website enquiries, online forms, email marketing and customer communications.

Detailed information about the Act is available on the Information Commissioner's Office (ICO) website.

ICO Guidance on DUAA

What's changing under DUAA?

DUAA introduces updates in several key areas, including:

  • Data protection complaints
  • Electronic marketing rules
  • Website tracking and cookies

These changes affect how organisations manage personal data and communicate with individuals.

Who does DUAA apply to?

The Act applies to all organisations that process personal data, from businesses and charities to associations, societies and public sector bodies.

If you collect personal information through your website, email marketing, social media or customer enquiries, you may need to review your current processes.

Key areas affected

Data protection complaints

New requirements apply to how organisations handle data protection complaints, including clear routes for raising concerns and set response expectations.

Read more about ICO complaint handling requirements.

Marketing and consent

Changes affect electronic marketing, including updates to how certain communications can be sent and how consent is managed.

Read our guide to charitable soft opt-in changes.

Cookies and website tracking

DUAA also affects cookie rules and website tracking practices. Organisations should review consent tools and notices to ensure they remain compliant.

What should you do?

Now is the time to review:

  • Privacy policies and website information
  • Complaint handling processes
  • Email marketing permissions
  • How personal data is collected and stored
  • Cookie notices and consent tools

Need help preparing for DUAA?

If you need support reviewing your website, forms or data processes, our team can help. Get in touch to discuss your needs.

Contact Us

Other News & Articles

DUAA Soft Opt-In For Charities Explained

DUAA Soft Opt-In For Charities Explained

Find out more about new rules under the DUAA which give charities more flexibility when communicating with supporters by email, text and other electronic messages.
ICO Complaint Handling Requirements 2026

ICO Complaint Handling Requirements 2026

New requirements coming into force on 19 June 2026 mean organisations must have a process for handling data protection complaints. Here's what's changing and what to do to get ready.
Email Marketing Content Ideas for Small Businesses

Email Marketing Content Ideas for Small Businesses

Struggling to think of what to send? Here are simple, practical content ideas to help you create more engaging and effective campaigns for your small business.