5 of 6: High-Risk Data Uses Under the DUAA — What Triggers Extra Oversight?
Not all data use is equal under the DUAA. Learn how high-risk uses—like AI, profiling, and sensitive data handling—trigger stricter obligations and oversight.
The Data Use and Access Act 2025 (DUAA) introduces a risk-based approach to data governance. Certain types of data use are considered high-risk and require additional scrutiny, documentation, and oversight. Understanding what qualifies as high-risk is essential for any company planning to share or re-use data under DUAA.
🚩 What Is “High-Risk” Use Under the DUAA?
DUAA does not use a fixed list of activities that are always considered high-risk. Instead, it relies on context and potential impact. However, the following activities are commonly flagged for enhanced governance:
- AI model training using personal or pseudonymised data
- Profiling or behavioural analysis for recruitment, credit, or insurance purposes
- Sharing sensitive personal data (e.g. health, ethnicity, biometrics)
- Cross-sector or international data flows with unclear accountability
- Automated decision-making with legal or significant effects on individuals
📋 DUAA Requirements for High-Risk Uses
If your organisation is involved in high-risk data activities, you must go beyond standard GDPR practices. Under DUAA, you may be required to:
- Conduct a Data Use Impact Assessment (DUIA), similar to a DPIA
- Notify or consult with relevant regulatory bodies
- Obtain higher-tier approvals internally before sharing data
- Document all processing purposes, legal bases, and safeguards in an Access Arrangement
- Establish regular audit or reporting mechanisms for ongoing use
⚠️ Example: High-Risk in Recruitment Analytics
Say a company uses data on past applicants to train an AI model that predicts candidate success. Even if the data is pseudonymised, the model’s outcomes could influence real hiring decisions. This triggers high-risk status under DUAA due to:
- Use of AI in decision-making
- Potential bias or discrimination risks
- Indirect effects on individuals’ opportunities
In this case, a Data Use Impact Assessment, an enhanced Access Arrangement, and clear purpose limits would be mandatory.
🔍 How Is This Different from GDPR?
While the UK GDPR (Article 35) also mandates Data Protection Impact Assessments (DPIAs), the DUAA widens the net by applying to both personal and non-personal data, and by emphasising organisational accountability even where individuals are not directly identifiable.
💡 Tip:
Maintain a risk register of all data uses in your organisation. Flag any activity involving AI, profiling, or sensitive categories for DUAA review. This will help you stay proactive and prevent non-compliance in high-risk areas.
