On August 21, 2025, the UK Information Commissioner’s Office (ICO) initiated public consultations to refine certain ICO guidance following amendments to UK data protection law passed under the UK Data (Use and Access) Act 2025 (DUAA). These amendments include the introduction of a new lawful basis referred to as “recognized legitimate interest,” and a requirement for organizations to establish a data protection complaints process.

• Recognized legitimate interest: This new lawful basis allows organizations to use personal information for certain pre-approved public interest purposes, including crime prevention, public security and emergency response. The ICO’s draft guidance on the new basis aims to clarify how it can be applied. In doing so, the ICO stresses that a public interest purpose must be present. The ICO advises that at this time, public authorities should continue to use the public task lawful basis for official functions.
• Data protection complaints process: By June 2026, organizations must implement a process to handle data protection complaints from individuals. The ICO states that the requirement ensures individuals can address grievances regarding personal information management. The ICO's draft guidance outlines what organizations must do to comply with the new requirement and suggests best practices for doing so, such as ensuring a clear complaints procedure is accessible to the public and maintaining a clear record of actions taken in response to a complaint.

The consultation on the ‘recognized legitimate interest’ guidance will close on October 30, 2025 (see consultation here), and the consultation on the data protection complaints process guidance will close on October 19, 2025 (see consultation here).

For more information on the changes introduced by the DUAA, see our previous article here.