DUAA 2025 and AI: Five Specific Provisions Regulated Practices Must Prepare For Now | Insights

The Data Use and Access Act 2025 is not a single regulation. It is a phased legislative programme amending the UK GDPR, the Data Protection Act 2018, and PECR simultaneously — with provisions commencing between June 2025 and June 2026. Most regulated professional services firms have not yet mapped which specific clauses affect their AI data processing obligations. This article isolates the five provisions that matter most.

For the full DUAA 2025 compliance analysis for AI-adopting law firms, read our parent article. This piece is the clause-level reference your Compliance Officer needs to brief the Managing Partner.

Provision 1: Compelled Witness Interviews and Mandatory Technical Reports

Status: In force since 5 February 2026.

The DUAA gives the ICO two investigatory powers it previously lacked. First, the power to compel individuals to attend interviews and answer questions under statutory notice. This is not a voluntary cooperation request. Failure to comply is an offence. When the ICO investigates a potential AI-related data breach at your firm, it can require your Compliance Officer, your IT Director, and named individuals to sit for formal examination.

Second, the power to require controllers or processors to commission a technical report from an approved independent expert — at the firm’s expense. The ICO specifies the subject matter. If the firm’s nominee is not approved, the ICO appoints its own expert. The resulting report is produced under statutory authority.

What this means for AI governance: If your firm’s AI controls consist of an Acceptable Use Policy and a training acknowledgement register, the compelled interview will expose the absence of technical enforcement. The mandatory technical report will document it. Both become part of the enforcement record.

Provision 2: Enhanced Information Notices — DPIA Production on Demand

Status: In force since 5 February 2026.

The DUAA amends the ICO’s information notice powers to permit the demand for specific named documents, not merely general information. The ICO can now require production of a Data Protection Impact Assessment, a transfer risk assessment, or any other specified compliance artefact.

What this means for AI governance: If your firm uses AI tools on client data — sanctioned or otherwise — and has not completed a DPIA, this is no longer a gap to address at your convenience. It is a document the ICO can compel. The DUAA further requires DPIAs to be retained for a minimum of five years and made available on request.

A DPIA for AI data processing must assess the specific risks of the processing, the technical and organisational measures in place to mitigate those risks, and the necessity and proportionality of the processing. If your “measure” is a policy document, your DPIA will document its own insufficiency. If your measure is a sealed network environment with no outbound data path, SSO access logging, and role-based access governance, your DPIA will document a verifiable control framework.

Provision 3: Mandatory Complaints Handling Procedure

Status: Commencing 19 June 2026.

Section 103 of the DUAA inserts a new Section 164A into the Data Protection Act 2018. Every organisation must establish a formal procedure for handling data protection complaints. The requirements are specific:

An accessible electronic complaints form, prominently linked from privacy notices and the firm’s website
Acknowledgement within 30 days of receipt
Investigation and response “without undue delay”
Decisions communicated in plain, accessible language
Individuals informed of their right to escalate to the ICO if dissatisfied

Complaint recording and tracking becomes mandatory. The firm must maintain logs showing receipt dates, investigation methods, remedial actions, and outcome communications. These records serve as compliance evidence — and as management information revealing patterns that require systemic remediation.

What this means for AI governance: When a client discovers that their privileged legal data was processed through ChatGPT by a member of staff who ignored the firm’s AUP, the DUAA complaint procedure creates an auditable paper trail. The client’s complaint must be acknowledged, investigated, and documented. If the investigation reveals that the firm had no technical control to prevent the processing, that finding is logged. If the client escalates to the ICO, the complaint file — including the firm’s own documented investigation — accompanies the referral.

The complaints procedure does not create the liability. The underlying breach does. But the procedure ensures that the firm’s failure to prevent it is formally documented and producible.

Provision 4: Automated Decision-Making Safeguards

Status: In force since 5 February 2026.

The DUAA revises Article 22 of the UK GDPR. The general prohibition on solely automated decision-making now applies only to significant decisions based entirely or partly on special category data (health, racial origin, political beliefs, religious views, biometric data). For all other categories, the DUAA broadens the lawful bases available for automated decisions.

However, the mandatory safeguards remain. Individuals subject to significant automated decisions must be able to:

Request human review of the decision
Challenge the decision and express their point of view
Receive clear, meaningful information about how the decision was made

More restrictive provisions continue to apply where special category data is involved — requiring explicit consent, contractual necessity, or substantial public interest justification.

What this means for AI governance: If your firm uses AI tools to assist with contract risk scoring, case prioritisation, due diligence summaries, or any process that informs decisions with legal or similarly significant effects on individuals, the ADM safeguards apply. You must document the decision-making process, implement human oversight mechanisms, and provide transparency to affected individuals.

An AUP that says “AI outputs must be reviewed by a qualified solicitor” addresses the human oversight requirement — but only if the firm can evidence that the review actually occurs. Without audit logs demonstrating that the solicitor reviewed the output before it was actioned, the safeguard exists on paper only.

Provision 5: PECR Fine Alignment — £17.5 Million Ceiling

Status: In force since 5 February 2026.

The maximum fine under the Privacy and Electronic Communications Regulations has increased from £500,000 to £17.5 million or 4% of global annual turnover — whichever is higher. This aligns PECR enforcement with UK GDPR penalty levels.

What this means for AI governance: While PECR primarily governs electronic marketing and cookies, the fine alignment signals the ICO’s broader enforcement trajectory. The regulator now has the same financial enforcement power across all its regulatory instruments. The era of low-ceiling fines that could be absorbed as a cost of doing business is over.

Combined with the ICO’s 2025 enforcement record — average fines rising from £150,000 to £2.8 million, with the £14 million Capita penalty as the headline — the PECR alignment confirms that the ICO is operating as a regulator with genuine financial deterrent power. Regulated professional services firms with turnover between £1 million and £50 million face potential fines that represent a material threat to the firm’s financial viability, not an administrative inconvenience.

The Preparation Checklist

For Managing Partners and Compliance Officers preparing for the DUAA’s full enforcement landscape:

Conduct a DPIA for all AI data processing — sanctioned and unsanctioned. Retain it for five years minimum. Ensure it documents verifiable technical controls, not policy intentions.
Establish a complaints procedure meeting the Section 103 requirements before 19 June 2026. Link it from your privacy notice and website. Implement complaint tracking and recording.
Audit your ADM practices to identify any AI-assisted decisions with legal or similarly significant effects. Document the human oversight mechanism and evidence that it operates.
Replace administrative controls with technical controls at the infrastructure level. A sealed network environment with no outbound data path, SSO access logging, and role-based access governance produce the evidence the DUAA demands. Acceptable Use Policies do not.

Talk to our team to understand how a sovereign AI deployment satisfies every DUAA provision analysed above — with technical evidence producible on demand.

Private AI Ltd (SC881079)