The final provisions of the Data (Use and Access) Act (DUAA) comes into force on 19 June 2026

With the legislation requiring organizations to provide a clear way for individuals to raise

concerns about potential data mishandling of data including the inappropriate use, or

concerns about AI and automated decision making, we talk with Susan Fletcher, Chief Privacy Officer, Precisely for some insights into how the legislation will impact businesses, and how organizations can prepare.

“The final provisions of the DUAA arrive at a pivotal moment for organizations.  As data volumes grow and AI becomes embedded in everyday business processes, the ability to trust, govern, and explain data is becoming a core business capability rather than simply a compliance requirement. The legislation reflects rising expectations that organizations must be able to demonstrate how their data is governed in practice, not just in theory.”

“One of the most significant changes is the requirement for organizations to strengthen internal handling of complaints relating to personal data ahead of potential regulatory escalation.  This raises the bar for data governance.  Businesses need to be able to quickly understand what data they hold, where it came from, how it has been used, and how decisions relating to that data were made.  Without that visibility, responding to concerns efficiently and transparently becomes increasingly difficult.”

“Strong data governance delivers measurable value.  Recent research shows that 71% of organizations with an ongoing data governance programme report high trust in their data, compared with 50% of organizations without one.  That gap highlights an important reality: organizations cannot effectively explain or derive value from data they do not fully understand.”

“The organizations best positioned for the DUAA era will be those that view privacy, data governance, and AI governance as interconnected disciplines rather than separate functions.  By building a unified approach to governance and accountability, organizations will not only be better positioned to meet regulatory expectations, but will also be better equipped to build lasting trust with customers, employees, and regulators alike.”