.png)
In the ever-evolving world of data protection, the UK seems determined to keep lawyers and businesses on their toes! The Data Protection and Digital Information Bill is poised to amend the UK version of the GDPR, reigniting discussions about user privacy and EU data relations.
For tech leaders, this bill might be good news - it promises to simplify compliance and empower organizations, potentially easing the regulatory burden. However, for those operating in Europe, the changes may have limited impact, other than to add even more complexity to an already very complex area.
Discover how this legislation may impact the operations and legal strategy of tech businesses operating in the UK. Dive deeper into the debate by reading our full article in the Solicitors Journal.
Read the Full Article in the Solicitors Journal
Working with data, launching a platform, or expanding globally? Our Cyber and Data Privacy lawyers can help you stay compliant and thoughtful about privacy from the start.
At Biztech Lawyers, we understand your entrepreneurial spirit. We're here to help you navigate the complexities of global data protection laws. Join us in exploring the nuances of this transformative legislation and stay ahead of the curve.
For leaders with vision, Biztech Lawyers is your partner in scaling your ambitions.



International law firm Biztech Lawyers elevates clients, providing vision and confidence to navigate global markets and seize opportunities.
The Data Protection and Digital Information Bill was a UK proposal to reform the UK GDPR and the Data Protection Act 2018 by stripping out compliance paperwork rather than replacing the regime outright. Supporters argued it would simplify compliance and empower organizations to make their own risk judgments. Critics argued that businesses operating in Europe would see limited practical benefit, since EU GDPR standards would continue to apply to them regardless, and privacy advocates questioned whether thinner documentation and accountability duties would still protect individuals in practice. The Bill would also have restructured the Information Commissioner's Office and rebranded it as the Information Commission.
The Bill was designed to reduce the paperwork and formalities needed to demonstrate compliance while keeping core data protection standards in place — lighter record-keeping for lower-risk processing, replacing the mandatory data protection officer role with a senior responsible individual in narrower circumstances, a less prescriptive approach to high-risk processing assessments, a wider basis for refusing burdensome data subject access requests, and a defined list of recognized legitimate interests removing the balancing test for certain purposes. Lighter formalities would not have removed the underlying duty to process personal data lawfully, fairly, and securely.
Compliance cost savings for small and micro-businesses were estimated at roughly £90 million a year across the economy. Small and micro-businesses were expected to achieve greater overall savings than larger businesses, since fixed compliance costs weigh proportionately more on smaller teams, though the figure is a government impact estimate rather than a guaranteed saving, and businesses with EU-facing operations may capture only a small share of it since they still need to meet EU requirements.
Under the DPDI Bill the mandatory data protection officer role would have been abolished and replaced by a senior responsible individual, required only where an organization is a public body or carries out high-risk processing. Because the Bill did not become law, UK data protection officer requirements can still apply to your organization, and a separate DPO obligation may arise under the EU GDPR if you process EU personal data.
The Bill would have replaced data protection impact assessments with a lighter assessment of high-risk processing that's less prescriptive about form and content, though an assessment would still be required where the processing is high risk. Documenting your assessment can still help demonstrate accountability if the regulator asks questions later, and processing that touches EU personal data may still require a full EU GDPR impact assessment.
The DPDI Bill would have allowed controllers to refuse a subject access request that is "vexatious or excessive," a lower threshold than the existing "manifestly unfounded or excessive" test — but the Bill did not pass, so the existing standard continues to govern refusals. If you do refuse a request, recording your reasoning and responding within the statutory timeframe will help mitigate the risk of a complaint or regulatory challenge.
A recognized legitimate interest is a listed purpose — such as national security, emergencies, crime prevention, and safeguarding — that a controller could rely on without carrying out the usual balancing exercise against the individual's rights and freedoms. Every purpose outside that list still requires the ordinary legitimate interests test and a documented assessment, and commercial activities such as analytics and profiling were not given a blanket exemption.
UK-only relief delivers limited benefit to businesses with European operations, since the EU GDPR continues to apply to your EU-facing processing whatever the UK does, and divergent rules can mean maintaining two sets of records, privacy notices, and assessments. Many groups choose to hold the higher EU standard as their internal baseline and treat UK relief as a floor rather than a target. Mapping which entity and which data flow sits under which regime is usually the first step, and experienced data protection and privacy lawyers can help you build a single compliance program that works across both jurisdictions.
Divergence from the EU GDPR can put the EU's adequacy decision for the UK under pressure, which matters because adequacy is what allows personal data to flow from the EU to the UK without additional safeguards. The European Commission has kept UK adequacy under review while reform progresses, extending it on a time-limited basis rather than granting an open-ended renewal — if adequacy were lost, EU-to-UK transfers would likely need standard contractual clauses supported by transfer risk assessments.
The Data Protection and Digital Information Bill never became law, because it fell when Parliament was dissolved in May 2024 ahead of the general election. The UK GDPR and the Data Protection Act 2018 continued to apply without interruption, and a successor reform, the Data (Use and Access) Act 2025, received Royal Assent on 19 June 2025, carrying forward some DPDI ideas while dropping others — including the senior responsible individual model.
Whether you’re looking for advice in a particular jurisdiction or exploring how we can help expand your business, discover more below.