4 of 6: What Is a DUAA Access Arrangement and When Do You Need One?

An Access Arrangement under the DUAA is a legal requirement for many data-sharing activities. Find out when your company needs one and what it must include.

One of the cornerstones of the Data Use and Access Act 2025 (DUAA) is the concept of an Access Arrangement. This formal document governs how data is shared and used between organisations. Getting this right is essential for companies managing data partnerships or external data processing.

📄 What Is a DUAA Access Arrangement?

An Access Arrangement is a contract or written agreement that sets out the legal, technical, and governance terms for data sharing under the DUAA. It must include key information such as:

• The type and classification of data being shared
• The identity and role of each party (data provider / data user)
• The lawful basis for sharing under UK GDPR
• Specific purposes for use and any usage limitations
• Retention period and data destruction requirements
• Audit, breach reporting, and oversight provisions

🕒 When Is an Access Arrangement Required?

Under the DUAA, an Access Arrangement is required when:

• Data is shared between separate legal entities or departments for re-use
• The use case is classified as high-risk (e.g. AI training, profiling, sensitive data)
• The data transfer involves automated decision-making or international recipients
• The data subject would not reasonably expect the sharing or use

Even if the data is pseudonymised, DUAA may still require an Access Arrangement due to its risk-based approach.

⚖️ DUAA vs UK GDPR Contracts

Many companies already use data processing agreements (DPAs) under GDPR. But Access Arrangements go further — they cover data access, purpose boundaries, risk controls, and shared governance, not just processor-controller roles.

Think of Access Arrangements as an additional layer of legal clarity and governance, tailored for complex or high-value data-sharing scenarios.

💼 Practical Example

A recruitment consultancy shares candidate analytics data with an AI vendor building a skills prediction model. Although a DPA may be in place, the DUAA would require an Access Arrangement to define how long the data can be used, what outcomes are permitted, and how the vendor’s use is audited.

💡 Tip:

Don’t rely solely on DPAs. If you’re sharing or receiving data outside typical processor relationships, assess whether a DUAA Access Arrangement is needed. Start by reviewing your top 10 data partnerships by volume or risk.