What the Data Use and Access Act 2025 Means for the Skills Sector

On 19 June 2025, the Data Use and Access Act (DUAA) received Royal Assent. It’s one of the most significant updates to the UK’s data protection regime since GDPR, with changes rolling out from August 2025 through June 2026.

While the Act applies to all organisations handling personal data, its impact on the skills sector - apprenticeship training providers, FE colleges, and adult learning organisations - is particularly important. These providers manage large volumes of sensitive learner data, much of it relating to young people or vulnerable adults, and are under growing regulatory scrutiny.

Key Changes in the DUAA

1. Scientific and Educational Research

• The Act explicitly allows data use for commercial and educational research.
• “Broad consent” is now permitted where learners’ data may be used for future research that cannot be fully defined at enrolment.
• Privacy notices may be published online instead of being issued individually if direct contact would be a “disproportionate effort.”

For providers, this opens new opportunities to use learner data to evaluate programme outcomes, identify gaps, and feed into sector-wide improvement projects.

2. Automated Decision-Making (ADM)

• Providers can now rely on “legitimate interests” (except for special category data) to support decisions driven by systems and analytics.
• With the right safeguards, this gives more freedom to use predictive analytics - for example, flagging learners at risk of withdrawal or forecasting achievement rates.

3. Data Subject Access Requests (DSARs)

• Providers are only required to carry out “reasonable and proportionate” searches when responding to DSARs.
• This reduces the administrative burden, especially where staff often receive time-consuming requests from learners, parents, or former apprentices.

4. Cookies and Tracking

• Low-risk cookies (analytics, site functionality) can be used without explicit consent.
• For providers, this means simpler management of online learning platforms, portals, and learner dashboards.

5. Children and Young People’s Data

• The Act strengthens the obligation to embed child-focused safeguards into systems and services.
• Apprenticeship providers working with 16–18 learners must review how platforms and processes protect younger learners’ data.

6. Complaints Handling

• All organisations must provide an electronic mechanism for data complaints, acknowledge them within 30 days, and respond without undue delay.
• Providers will need clear processes to meet this requirement, particularly given the sensitivity of funding data and ILR compliance.

Implications for the Skills Sector

For apprenticeship and adult skills providers, the DUAA brings both opportunities and responsibilities:

• Smarter use of data: Providers can confidently use learner data for programme evaluation, curriculum planning, and withdrawal prevention without excessive red tape.
• Increased trust: Strengthened safeguards for young people help reinforce trust with learners, parents, and employers.
• Operational efficiency: Proportionate DSAR searches and relaxed cookie rules will free up staff capacity.
• Regulatory pressure: ICO enforcement powers are stronger than ever, with fines of up to £17.5m or 4% of global turnover for breaches. For education providers reliant on public funding, reputational risk is as serious as financial penalties.

What Providers Should Do Now

• Review learner data policies, particularly around consent and research use.
• Audit automated decision-making processes (for example, learning analytics or risk rating tools) to ensure safeguards are in place.
• Update complaints procedures and train staff on the new requirements.
• Ensure websites and learner portals reflect updated cookie and tracking rules.
• Keep up to date with ICO guidance, which will continue to evolve as the DUAA is implemented.

Conclusion

The Data Use and Access Act 2025 is more than a compliance update - it’s an opportunity for skills providers to harness data more effectively while maintaining strong protections for learners. For apprenticeship and adult skills organisations, the message is clear: those who can use data responsibly and intelligently will be better placed to improve retention, demonstrate impact, and thrive in a highly accountable funding environment.