ICO launches consultation on DUAA’s new recognised legitimate interest

The question

Why does the Information Commissioner’s Office (ICO) consultation on recognised legitimate interest (RLI) draft guidance matter, and what should organisations be doing now?

The key takeaway

The consultation is helping to shape and clarify how the new RLI lawful basis will be applied in practice. Organisations should engage with this consultation and start reviewing their processing activities to identify where RLI may provide a more streamlined alternative to existing lawful bases.

The background

The UK Data Use and Access Act 2025 (DUAA) received Royal Assent on 19 June 2025. One of the key changes under DUAA was the introduction of the RLI – a new lawful basis for processing under the UK GDPR, which should not be confused with the existing legitimate interests basis. Controllers should note that they must still assess and confirm that the relevant processing is necessary for the legitimate interest or RLI.

The Department for Science, Innovation and Technology has summarised the RLI lawful basis, stating that it can be used to support processing that is necessary for:

• crime prevention
• safeguarding vulnerable people
• responding to emergencies
• safeguarding national security, or
• assisting other bodies deliver public interest tasks that are sanctioned by law.

  The Secretary of State has the power to amend this list where appropriate.

The development

On 21 August 2025, the ICO launched a public consultation on its draft guidance on RLI. The draft is already available, and the regulator is inviting responses to help inform and finalise it. It is intended to help organisations understand and apply the new lawful basis and is primarily aimed at larger organisations and data protection officers. The ICO will also produce a shorter summary and update its existing lawful basis guidance.

The consultation survey seeks feedback on the following points:

• whether the guidance is easy to navigate, sufficiently clear and contains the right level of detail
• how well it explains the differences between recognised legitimate interest and the existing legitimate interests basis
• respondents’ confidence in applying the new ground
• real-life use cases, and
• potential costs and benefits to organisations.

The consultation will remain open until 30 October 2025, and responses can be submitted via a survey on Citizen Space.

Why is this important?

Under the original legitimate interests basis, organisations were required to carry out a full Legitimate Interest Assessment (LIA), balancing the potential impact on individuals against the benefits of the processing. Instead, the new RLI ground instead provides a set of predefined situations that lawmakers have already determined to be legitimate by default. By removing the need for a full LIA in these cases, this basis can streamline a part of an organisation’s processing activities and ease the burden of compliance.

The consultation offers an opportunity to engage with the regulator and ensure the guidance is clear and workable for your organisation. Together with other ICO resources on the horizon, it will soon become an important tool for those seeking to unlock the full potential of the DUAA.

Any practical tips?

Organisations which are likely to consider relying on RLI should:

• submit feedback to the ICO
• review their current processing activities to identify where RLI may be applicable, to assess any benefit from the reduced regulatory burden
• monitor future regulations made by the Secretary of State, who may expand or narrow the categories of RLI over time, in order to ensure they both comply with the latest laws and take advantage of efficiencies when complying with the UK GDPR.

Autumn 2025