The Data (Use and Access) Act 2025 introduced several updates to the UK’s data protection framework in June 2025. While not an employment law statute, some of the changes are relevant to employers, HR teams and workplace investigators who regularly process employee data.
Subject Access Requests (SARs)
Organisations are now only required to conduct ‘reasonable and proportionate’ searches when responding to SARs. This reinforces an approach already adopted by the Information Commissioner’s Office (ICO) and the courts but now provides greater legal certainty.
In practice, employers will be better placed to resist demands that involve:
- Searching every backup system or archived database
- Conducting unlimited keyword searches across multiple platforms
- Reviewing large volumes of marginally relevant material
This is probably one of the most welcome reforms for employers and HR teams dealing with SARs submitted during grievances, disciplinary proceedings, redundancy processes and Employment Tribunal claims.
Complaints About Personal Data
A clear route for individuals to raise concerns about how their personal data is handled should now be provided by organisations. Most employers already do this via:
- Grievance procedures
- Data protection policies
- Data protection contact points
However, it is worth reviewing existing arrangements to ensure employees and former employees can easily raise concerns about personal data processing.
Legitimate Interests
There is now greater clarity around the use of legitimate interests as a lawful basis for processing personal data. Potentially relevant activities may include:
- Workplace investigations
- Fraud prevention activities
- Information security measures
- Regulatory compliance checks
For employers and HR teams, this may make it easier to justify some workplace investigations and monitoring activities that previously sat in a more uncertain area.
AI and Automated Decision-Making
The legislation relaxes some restrictions on automated decision-making, although safeguards remain where decisions involve special category data or have significant effects on individuals. This is particularly relevant given the increasing use of:
- AI recruitment tools
- Automated screening systems
- Workforce analytics
- AI-assisted performance management tools
However, employers and HR teams should not assume that this provides a free pass to use AI without human oversight.
What Does This Mean for Workplace Investigations?
For employers and HR teams, the most practical change is the clarification of the ‘reasonable and proportionate’ approach to SARs which should help employers define appropriate search parameters and avoid unnecessary investigation into vast amounts of data.
For workplace investigators, the clarification around legitimate interests will provide greater confidence in data processing information commonly used during investigations, including witness statements, interview notes, emails, CCTV footage and audit trail data.
Continued Need for Good Practice
At this stage, the amendments are unlikely to require widespread changes to employment contracts or HR procedures. Instead, employers should focus on reviewing:
- Subject Access Request procedures
- Investigation privacy notes
- AI and employee monitoring practices
Final Thoughts
None of the reforms remove the need to have a lawful basis for processing, inform employees how their data is used, retain information only for as long as necessary, protect confidentiality and comply with UK GDPR principles.
The more practical approach is to review the following:
- SAR procedures
- Investigation privacy notices
- AI and employee monitoring practices
These are the areas where employers are most likely to see a tangible impact from the legislation.
While the Act does not fundamentally alter employees’ existing obligations under UK GDPR and the Data Protection Act 2018, it provides greater clarity and flexibility in several key areas, helping organisations manage compliance more effectively.
Whether you’re reviewing your SAR procedures, conducting workplace investigations or introducing new AI tools, our experts can help you navigate with confidence. Get in touch for practical guidance on compliance, policy reviews and best practice for your organisation.
