Hot off the press: Update to the UK’s Data Bill – What You Need to Know and What you Need To Do Next

By Paul Alexander, CEO, Beyond: Putting Data to Work

On 10th June 2025, the UK’s Information Commissioner’s Office (ICO) quietly made an announcement that could have a significant impact on how your business handles data going forward. As debate continues around the Data (Use and Access) Bill, the ICO confirmed it will publish a new statutory code of practice for AI and automated decision-making - designed toclarify transparency, fairness, and accountability when deploying AI models in areas that involve personal data.

This is a move we welcome. Not because it adds another layer of compliance, but because it provides clarity - and clarity is a key enabler of confidence. The truth is many businesses already want to do the right thing with data. The challenge has always been knowing how. This new code could offer exactly that: a clear framework to help you innovate responsibly, without losing sleep over legal grey areas.

A Quick Recap: What Is the Data (Use and Access) Bill?

The Data (Use and Access) Bill is the UK’s long-awaited post-Brexit attempt to reshape data protection laws - aiming to retain EU adequacy, reduce red tape, and promote innovation.

The bill includes:

• A new legal basis for processing data using “recognised legitimate interests”

• Changes to Subject Access Requests (SARs)

• Revisions to rules on cookies, biometric data, and automated profiling

• A framework for digital identity verification

• Support for public interest research and innovation

• A new model for international data transfers (via updated adequacy rules)

  
  

However, the bill has become bogged down in parliamentary ping-pong, particularly over AI copyright transparency. The House of Lords wants tech companies to disclose copyrighted material used in AI training. The government has repeatedly rejected this, arguing it belongs in a future AI-specific bill.

What Happened on 10th June? - and Why It Matters

While politicians debated, the ICO stepped in, confirming it will publish a statutory AI code - likely in the next 6–12 months. This guidance will focus on how organisations use AI in decision-making processes that affect individuals. In practical terms, this will likely cover:

• The use of personal data in predictive models

• The need to explain how AI decisions are made

• How to mitigate bias and ensure fairness

• How to be transparent with customers and users

  
  

From our perspective at Beyond, this is a pivotal development. AI governance is no longer theoretical - it’s actionable. And it means that any business using AI for decision making, operations,  profiling, scoring, or personalisation will need to tighten up how they explain, monitor, and justify these processes.

What This Means for You

You’ve already heard us say it: Good data is the foundation of responsible AI. The upcoming ICO code won’t change that - it will reinforce it.

Here’s what you should be thinking about now:

1. Audit your data models

Start with the basics. What models are currently making decisions or influencing offers, communications, or customer journeys? Who oversees them? What data are they trained on?

2. Check your documentation

If challenged, could you explain how these models work? Could you show how you mitigate bias? Could your data science team provide a clear justification for the outputs?

3. Revisit your privacy notices and consents

Ensure your customer-facing materials reflect the reality of your data use. Transparency is no longer optional - it’s becoming regulated best practice.

4. Get your data in order

Whether it’s AI or not, data hygiene, governance, and segmentation strategies will be under scrutiny. This is your chance to lead, not scramble.

Putting Data to Work - Responsibly

As you know we’ve always believed in putting data to work in a way that’s not only effective, but ethical. That’s what builds trust. That’s what drives value. And that’s what keeps you one step ahead of regulation - rather than one misstep away from risk.

The ICO’s June 10th announcement is a warning shot for anyone hoping AI regulation would be delayed or diluted. It’s not. But for those ready to act now, it’s an opportunity to build smarter, safer, and more successful data practices.

Next Step...

If you’d like to review your data readiness or explore how we can support you with AI governance, drop us a line. We’re here to help you go further - with confidence.