This new Act of Parliament updates existing data protection laws and paves the way for things like artificial intelligence. It is supposed to make things easier for organisations but still protect people and their rights.
The changes will be phased between June 2025 and June 2026 so there is nothing to do immediately.
I think it will change two things for employers:
The first is that it makes clear that when dealing with a Subject Access Request, you only have to make “reasonable and proportionate searches” when someone asks for access to their personal information.
I hear you all saying ‘but what does a reasonable and proportionate search’ look like? Ultimately we don’t know until a court tells us, but the Information Commissioner’s office will be updating their guidance in due course, which will give us clues.
A reasonable search is likely to include using IT search tools to retrieve data. It probably isn’t reasonable to expect you to search archived data which would take you time and money to restore eg:- from tapes.
Is this likely to change much in real life? Probably not – we try our best to retrieve as much as we can when searching and if doing it properly are probably acting reasonably and proportionately already. If the request is ‘manifestly excessive’ we already have an existing pathway to charge a fee.
The second implication is that if you don’t already, you will need a data protection complaints process.
The DUAA requires you to take steps to help people who want to make complaints about how you use their personal data such as providing an electronic complaints form. You also have to acknowledge complaints within 30 days and respond to them ‘without undue delay’. At the moment, we tend to bury information about how to complain in the small print of privacy notices and at the back of policies. We probably need to put this a bit more front and centre going forward.
Refreshing Law
23 June 2025
02920 599993
07977 545480
adenton@refreshinglawltd.co.uk
Mornington
