The UK’s Data (Use and Access) Act 2025 is introducing a series of changes to the country’s data protection and digital information framework, with provisions covering data use, digital verification, automated decision-making and access to information. The legislation received Royal Assent on June 19, 2025, but its provisions are being brought into force in stages.

The Act does not replace the UK GDPR. Instead, it amends the existing data protection framework and introduces changes intended to facilitate data use while maintaining safeguards for individuals. Among other changes, the legislation establishes a framework for digital verification services and creates powers for new Smart Data schemes, under which data can be made available to authorised third parties.

For LegalTech companies, the changes are relevant to products that process personal information, automate decisions or use data to provide legal services. Contract management platforms, legal research systems, client onboarding tools and AI-based document analysis products may all be affected depending on the nature and purpose of the processing they perform.

The provisions concerning automated decision-making are particularly relevant as AI becomes more integrated into professional software. The revised framework changes the conditions under which organisations can make decisions using automated processing, while retaining additional safeguards for decisions involving significant effects on individuals.

The Act also introduces a more structured approach to digital verification services. This could have practical implications for LegalTech products involved in client onboarding, identity verification and access to regulated services, particularly where these functions can be integrated into broader digital legal workflows.

The phased implementation is itself important for LegalTech providers. Companies will need to monitor individual commencement dates and update privacy notices, product processes and compliance documentation as different provisions become operational. The legislation therefore creates an ongoing regulatory workstream rather than a single compliance deadline.

Image: Google DeepMind