How the DUAA Act impacts your Membership Organisation

Simplified Direct Marketing Rules Direct marketing, like sending newsletters, is now a “legitimate interest” under the UK GDPR, with a balancing test required. You benefit from relaxed “soft opt-in” rules, allowing electronic marketing to members without explicit consent, provided an opt-out is included. What it means for you: Update marketing policies, ensure clear opt-outs, and comply with PECR to avoid fines. Cookies Without Consent Cookies for analytics and content optimisation can be used without consent in low-risk cases, if an opt-out is provided. What it means for you: Update website cookie banners to include opt-outs and revise cookie policies. Data Subject Access Requests (DSARs) A “stop the clock” rule pauses the one-month DSAR response deadline if clarification is needed. Searches must be “reasonable and proportionate.” What it means for you: Update DSAR procedures to use the new rule and align searches with the standard.

Mandatory Complaints Process Organisations must have a formal data protection complaints process, including an electronic form, with complaints acknowledged within 30 days. What it means for you: Set up an online complaints form and train staff to respond promptly. Stronger ICO Enforcement The ICO gains powers to compel interviews, request reports, and issue fines up to £17.5m or 4% of turnover under PECR. What it means for you: Prioritise compliance, especially for marketing and cookies, to avoid penalties.