Legitimate interests, legitimate growth: a new chapter for direct marketing
The UK’s data protection landscape has entered a new chapter. The Data (Use and Access) Bill (DUA) has now received Royal Assent, becoming law on 19 June 2025. This is the first significant update to the UK’s data protection framework since the introduction of GDPR and simultaneously amends GDPR, the Data Protection Act 2018 (DPA) and Privacy and Electronic Communications Regulations (PECR). Beyond that, the DUA Act provides the framework for smart data services, digital verification services, a National Underground Asset Register, and much more.
The aims of the Act, as stated by the government, are to harness the power of data for economic growth, to enable modern digital government, and to improve people’s lives while maintaining high standards of data protection.
The DMA welcomes this legislation as a balanced and forward-looking reform package. It introduces a series of targeted updates designed to modernise how data is used in practice, supporting innovation, economic growth, and trusted customer engagement, while preserving robust individual rights.
The DMA has worked extensively on the Bill for 5 years beginning with the National Data Strategy which identified legislative reform as crucial for the UK to succeed in building a data-driven economy and public services. We held a member round table in October 2021 feeding our member’s priorities for customer engagement to senior government officials, and I’m delighted to confirm that the most significant priorities have made their way into the final text.
The print community identified legal certainty around use of legitimate interests as a critical priority. Backed by evidence provided by members across the supply chain, we were able to show that legal certainty could unlock over £500 million of investment. This includes spending on print production, data sales, creative development and postage. If brands feel confident that they can now use third party data based on legitimate interests for customer acquisition campaigns and to enrich existing customer profiles - enabling deeper, more profitable, long-term relationships - then a period of sustained growth could be in the offing, powered by increased use of direct marketing in the media mix
Amendments to Article 6(1)(f) of the DUA Act provided greater certainty to the scope of Legitimate Interests and includes three specific examples which are drawn from Recitals 47, 48 and 49 of GDPR. Specifically, Direct Marketing is the first example mentioned in the text.
This is wholly consistent with EU GDPR which is risk-based and proportionate. Recital 4 states clearly that Privacy is a fundamental right, not an absolute right, and must be balanced with other rights such as the right to conduct a business. There is nothing more fundamental to the right to conduct a business than attracting new customers and retaining existing customers. A business would not exist without customers nor a charity without donors.
Key wins for DMA members include:
- Greater clarity on legitimate interests as a lawful basis for direct marketing.
- Soft opt-in for charities, aligning fundraising communications with existing rules for commercial organisations. Εvidence provided by the DMA (and scrutinised by DSIT officials) indicates this would increase annual donations by £290 million.
- Reform of cookie consent requirements, reducing or removing banners where cookies are used for low-risk, first-party purposes. This may mean many organisations such as charities, b2b and pure play ecommerce might be exempt from pop-up consent banners.
- Preservation of EU adequacy, ensuring data flows between the UK and EU remain uninterrupted.
- A modernised Information Commissioner’s Office, now required to consider innovation and competition alongside privacy.
- Legal basis for unified Codes of Conduct covering both GDPR and PECR, enabling joined-up guidance and accountability.
- Clarity around scientific and market research, formally recognising commercial research under the protections of GDPR.
- Harmonised definition of direct marketing across GDPR, PECR and DPA 2018, ensuring legal consistency.
- Stronger enforcement under PECR, with maximum fines raised to match GDPR levels.
The DMA expects these changes to take effect in around six months and we will be very active during the six-month implementation phase to ensure ICO Guidance reflects the intent of the legislation. The ICO’s plans for new and updated guidance1 includes publishing draft guidance on key aspects of the legislation for consultation through the summer and autumn. The DMA will respond to each consultation expressing the views of our members with meetings planned to explore any significant concerns with the ICO. We have already begun to publish resources that will help our members take full advantage of the opportunities.
To find out more about DMA resources and how DMA membership can help your organisation contact chris.combemale@dma.org.uk
The author, Chris Combemale, is Director of Policy and Public Affairs at the DMA, representing the UK’s data and marketing industry. He leads policy advocacy, promotes responsible data use, and champions customer-first principles across business and government. Chris is Chair of JICMAIL, co-Chairs Fedma and is a board director of the GDMA, Asbof and CAP.
About the DMA
The DMA is the voice of the data and marketing industry. Its Code sets the standard for marketers to “do data right” so that growth is fuelled by integrity and customers trust the brands who sell to them. The DMA’s advocacy on the DUA Bill has been centred on its customer first principles enshrined in the DMA Code, which strikes a balance between innovation and privacy designed to build trust between brands and their customers for long term, loyal relationships.
