In the UK’s modern industrial strategy published last year, data and technology have moved from supporting tools to core infrastructure for productivity, innovation and long-term economic renewal.   Data is now a strategic national asset, comparable in importance to physical infrastructure. Better data use can improve public services, support investment, enable AI adoption and help businesses build stronger customer relationships.  That is the policy context for the Data Use and Access Act. The DUA Act belongs in the UK’s growth agenda because better data use is central to productivity, investment and customer engagement. Its purpose is to enable better data use across the economy and public sector while maintaining a high standard of protection for individuals.   The reforms reach well beyond marketing. The Act includes measures to improve NHS data interoperability, support the creation of a National Underground Asset Register, digitise registers for births and deaths, and establish frameworks for smart data schemes such as Open Property. These reforms point in the same direction: removing friction, improving services and raising productivity through better data use.  For the Data & Marketing Association, the most significant reforms are those that give organisations more confidence to use data responsibly. Growth depends on understanding customers, communicating with relevance and cutting waste from poorly targeted activity. That is where data use becomes commercial: better engagement, less waste and stronger returns from marketing investment.   The DUAA Act provides greater certainty around the use of legitimate interests as a lawful basis for processing personal data. Organisations relying on legitimate interests must show that processing is necessary and carry out a balancing test, weighing their interests against the rights of individuals.   The balancing test creates accountability. It requires marketers to think carefully about the impact of their plans on customers and gives responsible organisations a route to act where the use of data is fair, proportionate and linked to a legitimate purpose.  This balance has always been central to the GDPR. Recital 4 states that the processing of personal data should be designed to serve mankind, and that data protection rights must be balanced against other fundamental rights such as the right to conduct a business. For marketers, attracting and retaining customers sits at the centre of commercial activity. A business cannot grow without customers, and a charity cannot grow without donors. That is why direct marketing has long been recognised as capable of being a legitimate interest.   Since the implementation of GDPR, many lawyers and data protection officers have created uncertainty by advising companies that consent was “safer”, even though legitimate interests and consent are equal in the text. This has fuelled a misconception that GDPR requires consent for almost any use of personal data. That has limited growth at a critical time in economic recovery without delivering additional protection for individuals. 

As marketing automation becomes more sophisticated, marketers must own that responsibility alongside legal and compliance teams. 

The amendments to Article 6.1.f in the DUAA Act provide greater certainty by setting out illustrative examples of legitimate interests, drawn from Recitals 47, 48 and 49 of GDPR. For DMA members, the inclusion of direct marketing is especially significant. The DMA proposed and fought strenuously for this amendment because it places clarity in the main legislative text, consistent with the original recitals, with an impact far beyond marketing.  The same proportionality and risk-based approach will shape how organisations deploy AI in marketing and customer engagement. Updates to profiling and automated decision-making in Article 22 GDPR find a better balance between innovation and privacy, and reaffirm legitimate interests as a valid lawful basis, except where special category data is involved.  As marketing automation becomes more sophisticated, marketers must own that responsibility alongside legal and compliance teams.  The creation of a charity soft opt-in for email marketing will enable charities to communicate with existing supporters without consent in defined circumstances. Evidence submitted by the DMA demonstrated that this initiative could increase donations to charities by as much as £290 million annually.  Cookie-banner reform addresses one of the most visible failures in the current system. All politicians and regulators the DMA has spoken to agree with eliminating consent pop-up banners for cookies. They interrupt the online customer experience, reduce productivity and often fail to create meani...