Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
The Data Protection and Digital Information Bill is no longer the current legislation. Its policy programme evolved into the Data (Use and Access) Bill, which became the Data (Use and Access) Act 2025 (DUAA) on 19 June 2025. The Act amends the UK GDPR, Data Protection Act 2018 and Privacy and Electronic Communications Regulations (PECR); it does not replace them. The Information Commissioner’s Office (ICO) says the Act’s data-protection provisions were all in force by 19 June 2026.
For UK businesses, the result is a targeted recalibration rather than a wholesale deregulation: some specified data uses have more flexibility, while new complaints-handling duties and stronger regulatory tools make sound processes and evidence more important.
From the DPDI proposal to current law
The name in the title refers to an earlier reform proposal. The legislation businesses now need to understand is the DUAA:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →- 23 October 2024: the Data (Use and Access) Bill was introduced.
- 19 June 2025: it received Royal Assent and became the Data (Use and Access) Act 2025.
- 5 February 2026: a major data-protection and privacy commencement stage took effect.
- 19 June 2026: the ICO reported that all data-protection provisions were in force.
The Act works by amending the existing framework: the UK GDPR, the Data Protection Act 2018 and PECR. Organisations should continue to use those laws as their compliance baseline and identify which amendments affect their specific processing. The ICO’s overview for organisations and the government’s commencement guidance set out the current position.
#1 Best Overall
- PORTABLE SCANNER FOR USE ON-THE-GO — The fastest and lightest mobile single-sheet-fed compact document scanner in its class¹
- QUICK DOCUMENT SCANNING ― This Epson ultra-fast scanner scans a single page as quickly as 5.5 seconds²; Windows and Mac compatible
- VERSATILE PAPER HANDLING ― Portable scanner scans documents up to 8.5 x 72 in; Also easily digitizes receipts and ID cards to make accounting, bookkeeping, and organizing simpler
- INTUITIVE, HIGH-SPEED SOFTWARE — Epson ScanSmart Software³ is a smart tool allowing you to easily scan, review, and save; Stay organized easily with the help of this Epson scanner
- EASY SETUP — USB-powered connect to your computer for quick and simple scanning; No batteries or external power supply required to operate portable document scanner; Standard Connectivity: USB 2.0
What changes for industry?
| Area | What the Act changes | What organisations should do |
|---|---|---|
| Lawful processing | A limited set of recognised legitimate interests is introduced. | Check eligibility and document necessity; do not treat it as a general replacement for consent. |
| Automated decisions | The framework for certain solely automated decisions is more permissive, subject to safeguards. | Inventory significant decision systems and provide meaningful review and challenge routes. |
| Subject access requests | The rules clarify search expectations and when the response period begins in relevant cases. | Update intake, identification and reasonable-search procedures. |
| Individual complaints | Organisations must offer a complaints route, acknowledge complaints within 30 days and respond without undue delay. | Provide an electronic route and assign ownership, escalation and record keeping. |
| Cookies and similar technologies | Some specified lower-risk uses may qualify for consent exemptions. | Classify trackers by what they actually do, not their marketing label. |
| Research and archiving | Some reuse for scientific research, public-interest archiving and statistics has more flexibility. | Document purpose, safeguards, transparency and rights handling. |
| International transfers | Some rules are clarified or simplified, but transfer obligations can still apply. | Review destinations, access, onward transfers and applicable safeguards. |
| ICO oversight | The regulator’s governance changes and it gains additional investigative tools. | Keep evidence organised and respond promptly to regulatory requests. |
Recognised legitimate interests: a narrow route, not a shortcut
The DUAA creates a lawful basis for specified recognised legitimate interests. Listed purposes include crime prevention, safeguarding vulnerable people, responding to emergencies, national security and assisting other bodies with public-interest tasks authorised by law. Where a purpose qualifies, the organisation must still show that processing is necessary, but does not have to perform the usual balancing test for the conventional legitimate-interests basis. See the government’s UK GDPR and DPA factsheet.
This may help, for example, a bank sharing information necessary to prevent fraud or organisations coordinating an emergency response. It is not a general basis for commercial marketing, behavioural advertising, product analytics or AI training simply because an organisation prefers not to seek consent. Purpose limitation, transparency, security, data minimisation and other applicable duties remain relevant. For each processing activity, record the purpose, the precise legal route, why processing is necessary, whether special-category data is involved and what safeguards apply.
Rank #2
- FAST SPEEDS - Scans color and black and white documents a blazing speed up to 16ppm (1). Color scanning won’t slow you down as the color scan speed is the same as the black and white scan speed.
- ULTRA COMPACT – At less than 1 foot in length and only about 1. 5lbs in weight you can fit this device virtually anywhere (a bag, a purse, even a pocket).
- READY WHENEVER YOU ARE – The DS-640 mobile scanner is powered via an included micro USB 3. 0 cable allowing you to use it even where there is no outlet available. Plug it into you PC or laptop and you are ready to scan.
- WORKS YOUR WAY – Use the Brother free iPrint&Scan desktop app for scanning to multiple “Scan-to” destinations like PC, Network, cloud services, Email and OCR. (2) Supports Windows, Mac and Linux and TWAIN/WIA for PC/ICA for Mac/SANE drivers. (3)
- OPTIMIZE IMAGES AND TEXT – Automatic color detection/adjustment, image rotation (PC only), bleed through prevention/background removal, text enhancement, color drop to enhance scans. Software suite includes document management and OCR software. (4)
Automated decisions and AI: more room, with safeguards
The Act widens the circumstances in which organisations can make solely automated decisions with legal or similarly significant effects. That may matter in credit and insurance, recruitment, fraud detection, customer eligibility, pricing and public-service administration. It does not make consequential AI decisions unrestricted. Safeguards include information about significant decisions, a way for individuals to make representations and challenge an outcome, and an opportunity to obtain human intervention. Special-category data remains subject to stronger restrictions.
Free tools Windows power users keep installed
One-click scans. No signup required.
Distinguish a system that gives a person a recommendation from one whose result is routinely accepted without meaningful review. Calling a process “human in the loop” is not enough if reviewers cannot see relevant information, lack authority to change the result, face unworkable volumes or merely rubber-stamp the system’s answer. For each significant system, document its inputs, decision factors, affected people, review and appeal routes, audit logs, explanation materials and accountable owner. Check data quality and assess risks such as discriminatory outcomes and over-reliance on vendor assurances. The ICO’s summary of data-protection changes provides further detail.
Rank #3
- FAST DOCUMENT SCANNING — Document scanner with feeder allows you to speed through stacks with a 50-sheet Auto Document Feeder (ADF); Efficient office scanner to help you scan more productively
- INTUITIVE, HIGH-SPEED SOFTWARE — Quickly scan with this desktop document scanner; Epson ScanSmart Software lets you easily preview scans, email files, upload to the cloud, and more; Plus, automatic file naming saves even more time
- SEAMLESS INTEGRATION — Easily incorporate your data into most document management software with the included TWAIN driver; Office document scanner integrates seamlessly with business workflows
- EASY SHARING — Duplex scanner allows you to scan straight to email or popular cloud storage2 services like Dropbox, Evernote, Google Drive, and OneDrive for simple storage and sharing
- SIMPLE FILE MANAGEMENT — Scanner allows the creation of searchable PDFs with Optical Character Recognition (OCR) and convert scans to editable Word or Excel files effortlessly; Designed for home and office document scanning
Subject access requests and complaints
The Act clarifies that organisations need to conduct reasonable and proportionate searches rather than search every conceivable system without limit. It also clarifies when the one-month response period begins in cases where the controller needs information reasonably required to identify the requester or locate the requested data. This is not permission to delay a response casually or make a superficial search. Update request forms and staff guidance, record the systems searched and explain why any search scope was excluded.
A separate operational change is the duty to provide a way for people to complain about how their personal information is handled. Organisations must help people make complaints, including through an electronic form, acknowledge complaints within 30 days and respond without undue delay. Build a route that customer-service teams can use, assign escalation to the appropriate privacy or legal staff, and preserve the complaint, investigation and response record. The ICO’s organisational guidance describes these requirements.
Rank #4
- Scanner type: Document
- Connectivity technology: USB
- With Auto Scan Mode, the scanner automatically detects what you're scanning
- Digitize documents and images
Cookies: assess the technology, not its label
Some storage and access technologies used for specified lower-risk purposes, including certain statistical or functionality improvements, may be used without explicit consent under the amended rules. That does not remove consent requirements for all analytics, advertising, attribution, session-recording or profiling technologies.
A tool sold as “analytics” might also support advertising attribution, cross-site tracking or user profiling. Its actual configuration, data collected and purpose matter more than its name. Inventory first-party and third-party tags, test vendor settings and distinguish necessary functionality and security from measurement, personalisation, advertising and tracking. Do not assume a cookie banner is unnecessary based on a product description or a scanner’s default category.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Research, international transfers and the regulator
The Act allows greater flexibility for certain reuse of personal information for scientific research, public-interest archiving and statistical purposes. In some circumstances, an additional privacy notice may not be required where providing it would involve disproportionate effort, subject to applicable safeguards and transparency measures. Research, university and life-sciences teams should still record the purpose, the basis for reuse, access controls, retention, minimisation, public explanations and how individual rights will be handled.
Best Value
- OUR MOST ADVANCED SCANSNAP. Large touchscreen, fast 45ppm double-sided scanning, 100-sheet document feeder, Wi-Fi and USB connectivity, automatic optimizations, and support for cloud services. Upgraded replacement for the discontinued iX1600
- CUSTOMIZABLE. SHARABLE. Select personalized profiles from the touchscreen. Send to PC, Mac, mobile devices, and clouds. QUICK MENU lets you quickly scan-drag-drop to your favorite computer apps
- STABLE WIRELESS OR USB CONNECTION. Built-in Wi-Fi 6 for the fastest and most secure scanning. Connect to smart devices or cloud services without a computer. USB-C connection also available
- PHOTO AND DOCUMENT ORGANIZATION MADE EFFORTLESS. Easily manage, edit, and use scanned data from documents, receipts, photos, and business cards. Automatically optimize, name, and sort files
- AVOIDS PAPER JAMS AND DAMAGE. Features a brake roller system to feed paper smoothly, a multi-feed sensor that detects pages stuck together, and skew detection to prevent paper damage and data loss
Some international-transfer rules are clarified or simplified, but the Act does not mean every overseas arrangement is free of transfer requirements. A UK contract, reseller or data centre does not by itself settle the question if overseas support staff or group companies can access the data. Review cloud, outsourcing, HR and customer-support arrangements, destinations, onward access, transfer mechanisms and relevant contractual or risk-assessment safeguards.
The Act also replaces the ICO’s previous governance arrangement with an Information Commission led by a chair, chief executive and executive and non-executive members. It provides additional enforcement tools, including clearer document requests through information notices, assessment notices that may require an organisation to commission and pay for a report assisting an investigation, and interview notices requiring a person to attend and answer questions. These changes make organised records and timely cooperation important even where a business is using a newly clarified lawful route. See the government’s ICO factsheet.
Practical checklist for UK organisations
- Map your legal baseline. Identify which activities fall under UK GDPR, the Data Protection Act 2018 and PECR. Note the DUAA amendments relevant to each activity.
- Recheck lawful bases. For each purpose, record the basis and whether a narrowly defined recognised legitimate interest applies. Document necessity and safeguards; do not relabel ordinary advertising or marketing.
- Inventory automated decisions. Include systems used in recruitment, lending, insurance, pricing, fraud and service eligibility. Identify significant effects, human-review authority, challenge routes, logs and ownership.
- Build the complaints workflow. Offer an accessible electronic route, configure acknowledgement tracking for the 30-day deadline, define escalation and ensure responses are handled without undue delay.
- Refresh SAR playbooks. Clarify identity and locating information requirements, clock-start rules and proportionate search methods. Keep a record of search scope and decisions.
- Audit cookies and trackers. Classify by purpose and actual behaviour, including third-party tags and vendor settings. Confirm which technologies genuinely meet an exemption and which still require consent.
- Review research reuse and transfers. Document safeguards, transparency and rights handling for research. Map overseas access, subprocessors and onward transfers, then confirm applicable transfer protections.
- Prepare for scrutiny. Keep processing records, decision rationales, vendor documentation and complaint outcomes accessible. A software tool can help organise evidence, but does not itself make processing lawful.
What the Act does not mean
- UK GDPR has not disappeared; the DUAA amends it and related legislation.
- Consent is not generally optional, and recognised legitimate interests are limited to specified purposes.
- Automated decision safeguards and stronger protections for special-category data remain relevant.
- Cookie exemptions are not universal and depend on the technology’s purpose and configuration.
- Documentation, security, individual rights and regulatory cooperation still matter.
The Act may reduce unnecessary friction for qualifying uses, but it does not guarantee lower compliance costs for every organisation. Businesses benefit from the additional flexibility only when they can classify their processing accurately, establish why a route applies, maintain appropriate safeguards and handle requests, complaints and regulatory scrutiny effectively.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
