Trowers Tech News

Top tech trends: evolving digital regulation

New provisions under the Data (Use and Access) Act 2025 (DUAA)

On 5 February 2026, a significant number of provisions of the Data (Use and Access) Act 2025 (DUAA) came into force pursuant to the Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026.

Perhaps one of the most significant changes is the introduction of "recognised legitimate interests" as a new lawful basis for processing personal data under section 70 of the DUAA. Qualifying interests include processing necessary for national security purposes, the investigation of crime, responding to requests from public bodies, and the safeguarding of vulnerable individuals. Importantly, controllers relying on this basis are not required to carry out a balancing test weighing the benefits of processing against the potential impact on individuals' rights. This is a notable departure from the existing "legitimate interests" basis under UK GDPR, which requires controllers to conduct such a balancing exercise, and it is likely to be welcomed by organisations whose processing activities fall within the qualifying categories.

The DUAA also introduces enhanced safeguard requirements for online services likely to be accessed by children. Such services must now account for children's higher protection matters, recognising both the vulnerabilities of children and the specific protections their personal data warrants. This obligation reinforces that child safety online is a compliance priority that businesses operating consumer-facing digital services must take seriously.

On international data transfers, section 85 of the DUAA reforms the process by which the Secretary of State may designate a third country or international organisation as providing adequate protection for personal data. Under the new framework, the Secretary of State must assess whether the standard of data protection in the recipient country is "not materially lower" than that afforded under UK law - a more flexible formulation than the existing adequacy standard, which is derived from the UK GDPR. Where such a designation is made by regulation, transfers of personal data to that country or organisation may proceed without the need for additional safeguards such as International Data Transfer Agreements (IDTAs).

Further changes include welcome clarifications to data subject access requests (DSARs). Controllers will now be able to formally demonstrate that seeking clarification from a requestor is reasonably required in order to respond meaningfully to a DSAR. Where clarification is requested, the applicable time limit for responding is paused until the requested information is received. Separately, the soft opt-in exemption for electronic marketing is now extended to charities, allowing them to make regular contact with existing supporters without requiring fresh consent for each communication. Additionally, the DUAA introduces a new statutory definition of "research," together with confirmation that broad consent can be given for data processing in certain research contexts. These changes should provide welcome certainty for research organisations and charities alike.

Looking ahead, the ICO has published good practice guidance on data protection complaints handling. Under the guidance, organisations must provide a formal complaints mechanism, acknowledge receipt within a reasonable period - typically 30 days, and resolve complaints without undue delay. In light of the new provisions and the ICO's updated enforcement focus, businesses should now prioritise reviewing and updating their data protection policies, procedures and records of processing activities to ensure they remain compliant.

Matt Whelan, Senior Associate

Keeping UK Tech at Home: Reeves' £2.5bn Bet on Quantum and AI

Chancellor Rachel Reeves has pledged £2.5 billion of government investment in quantum computing and artificial intelligence, with an explicit goal of stopping British technology from "drifting abroad". The announcement reflects growing concern at the highest levels of government about a well-established pattern: many tech firms that start in the UK end up moving their businesses overseas, often to the US. The suggested reasons for this talent and capital flight are varied, including poor investment from the UK government and pension funds, the perceived weakness of the London Stock Exchange, and better tax breaks available elsewhere. For businesses and their advisers, this is not merely a political story - it has direct commercial and legal implications for how UK tech companies are structured, financed, and ultimately governed.

Quantum computing is considered far more powerful than regular computing because it can store many times more information, and is seen by many as the next big breakthrough in technology and a key driver of economic growth. Ashley Montanaro, co-founder and CEO of British quantum firm Phasecraft, acknowledged there had been high-profile examples of UK-based firms being acquired by larger overseas companies or their founders relocating to the US, while welcoming the Chancellor's focus on retaining the UK's position as a leading destination for quantum computing.

The investment forms part of a broader growth strategy, which Reeves has paired with plans for closer ties with the EU and greater regional powers. She has indicated that the UK should align more closely with EU rules where it is in the national interest, with alignment in food and farm standards already planned, but her words potentially signalling a wider push across areas such as chemicals and manufacturing.

Whether this injection of public capital will be sufficient to reverse the trend remains to be seen. What is certain is that for law firms advising in the tech sector, questions of cross-border investment, corporate restructuring, and the regulatory landscape for emerging technologies will only grow in significance in the months ahead.

Anna Horsthuis, Senior Associate

Open source, cloud, legacy products: does the Cyber Resilience Act apply to you?

On 3 March 2026, the European Commission published its first draft guidance on the EU Cyber Resilience Act (CRA). This is a pivotal moment for manufacturers, developers and distributors of hardware and software products across the EU market, providing the clearest signal yet of how mandatory cybersecurity requirements will apply in practice.

The guidance resolves several long-standing grey areas on software scope. Software made available by download or remote access is in scope, while demo and tutorial code is not. A genuine data connection is required; using electricity alone is insufficient.

On open source, responsibility turns on who controls a project through governance rather than who holds commit rights. Free software can trigger full manufacturer obligations where it is monetised.

Updates that introduce new threat vectors may constitute a substantial modification, resetting CRA obligations entirely and making the modifier the manufacturer. The five year minimum support period is not a universal default and must reflect realistic product lifecycles, with each software version requiring its own declared period.

Product classification depends on core functionality as a whole rather than individual components, and third party and open source components must be actively risk assessed. Remote data processing falls within scope only where the product functionally depends on it and the manufacturer controls the software. Vulnerability reporting obligations include a 24 hour early warning and 72 hour full notification requirement.

Key dates to note:

• 11 June 2026: conformity assessment body notification rules apply

• 11 September 2026: vulnerability and incident reporting obligations begin

• 11 December 2027: full CRA obligations apply

For businesses in regulated sectors such as automotive or medical devices, the guidance also touches on interactions with other EU legislation and sector-specific scope exclusions. The consultation closed 31 March 2026. Businesses should review the draft against existing CRA programmes, reassess scoping and product classifications, refine support period strategies and establish clear criteria for identifying substantial modifications.