The Data Use and Access Act 2025 (DUAA) Update
The Data Use and Access Act 2025 (DUAA) represents one of the most significant reforms to UK data protection law since the introduction of the GDPR. Coming into force on 5 February 2026, the Act introduces changes aimed at modernising digital information management while supporting innovation and reducing unnecessary burdens on organisations—including charities. One of the most transformative updates for the voluntary sector is the extension of the “soft opt‑in” to charities, allowing them to email marketing communications to supporters under specific conditions.
Previously, charities were excluded from using the soft opt‑in under PECR (Privacy and Electronic Communications Regulations). This meant they had to rely on explicit opt‑in consent, significantly limiting their ability to contact donors and supporters. With the DUAA now in effect, the rules change dramatically.
What Has Changed Under the DUAA?
The DUAA amends PECR by introducing a new provision – the “charitable purpose soft opt‑in” – bringing charity email marketing rules more in line with those for commercial organisations.
This change allows charities to send electronic marketing messages without explicit consent, provided specific statutory conditions are met.
How the Charitable Soft Opt‑In Works
To rely on the soft opt‑in, all of the following criteria must be satisfied:
- Charitable Purpose Requirement
The sole purpose of the direct marketing communication must be to further one or more of the charity’s charitable purposes. Examples include appeals, impact updates, campaigns, or event promotion aimed at advancing the charity’s mission.
- Source of Contact Details
The supporter’s contact details must have been obtained when they:
- Expressed an interest in the charity’s charitable purposes, or
- Offered or provided support to further those purposes (e.g., making a donation, volunteering, requesting information).
This means if a supporter donates, signs up for an event, or asks for updates, their email address may be used for future marketing—without needing them to explicitly tick an opt‑in box at that moment.
- Opt‑Out Requirement
A simple, clear, cost‑free opt‑out must be offered:
- At the point their details are collected, and
- In every subsequent marketing communication.
This shifts charities from an opt‑in model to an opt‑out model—a major regulatory shift.
Who Can Use the Soft Opt‑In?
Only organisations that meet the legal definition of a charity under the Charities Act 2011 (or equivalent legislation in devolved nations) can use the charitable soft opt‑in. Other non‑profits or social enterprises cannot rely on it unless legally defined as charities.
Types of Communications Covered
The soft opt‑in applies to electronic mail, including:
- SMS
- Direct messages via social media platforms
It does not apply to telephone marketing, which remains governed by stricter PECR rules requiring explicit consent or compliance with the Telephone Preference Service (TPS).
When Does It Apply?
The charitable soft opt‑in applies only to data collected on or after 5 February 2026.
Charities cannot retrospectively apply this exemption to older supporter data unless that data already meets the new legal conditions.
Practical Implications for Charities
- Improved Fundraising and Supporter Engagement
The changes are expected to significantly expand charities’ reachable audiences, helping them maintain stronger connections with new supporters.
- Reduced Administrative Burden
The shift from compulsory explicit consent reduces compliance overhead while remaining within a clear and controlled framework.
- Necessity for Governance and Documentation
Charities must still demonstrate accountability and lawful processing. Experts recommend carrying out a Legitimate Interest Assessment (LIA) before using soft opt‑in for campaigns.
- Greater Clarity Around Data Use
The DUAA also introduces improvements beyond marketing, such as clearer wording on data transparency and more flexible use of data for research and statistical purposes.
What Should Charities Do Now?
To prepare for and effectively use the charitable soft opt‑in, charities should:
- Review supporter data collection methods, ensuring opt‑out options are clear and properly recorded.
- Update privacy notices and supporter engagement forms.
- Train staff and volunteers on new DUAA marketing rules.
- Implement or update LIAs to justify marketing communications.
- Update email templates to include accessible opt‑out links.
By taking these steps, charities can safely and effectively embrace the new opportunities provided by the DUAA while maintaining public trust.
DUAA opportunities for charities
The Data Use and Access Act 2025 marks a turning point for UK charities. For the first time, they can lawfully rely on the soft opt‑in to grow their supporter engagement via email, SMS, and digital messaging – reducing friction, expanding reach, and enabling more mission‑driven communications.