The new Data (Use and Access) Bill and Scottish data practitioners in 2025: understanding what is next in data reform

Tuesday 20th May 2025

Data protection requirements for all organisations in the UK and Scotland are governed by law setting out what needs to be complied with and how.  However, the new Data (Use and Access) Bill is moving swiftly through Parliament and will conclude during 2025.  This Bill contains a range of changes with implications for all data practitioners and data protection officers, impacting on when, how and why compliance is needed.  Do you know what data practitioners and organisations need to understand about what will be in the new Act, what changes and responses will be required and what the impact will be of the other wider drivers of change in the data environment?

The Bill proposes a range of changes to the data regulatory regime and is intended to modernise how data is used and accessed across public and private sectors.  The legislation aims to create a framework which balances innovation with privacy.  Its objectives include streamlining access to data for innovation, protecting personal data and encouraging public trust.  Key features of the Bill include the introduction of data intermediaries, the creation of a trust framework and new provisions regarding data sharing for public interest.  The Bill also introducues a range of changes for data protection and privacy legislation ranging from data subject access requests through to fines and penalties and, perhaps, enhanced enforcement powers for the Information Commissioner’s Office.

This regulatory change takes place, as ever, in the context of serious ongoing data protection challenges.  These range from widespread inadvertent disclosures through to WhatsApp data lapses following its widespread use during and since pandemic.  Physical breaches continue to manifest with a range of organisations seeing personal data exposed.  Training is critical in data management and, in most cases, failing to train underpins breach occurrences.  The pace and volume of data sharing, driven by responses to externalities such as AI and changes in work patterns and locations continues to increase dramatically.  The huge value of data as the life blood of both public services delivery and private sector competition, with the scale of associated data management required, increases the compliance burden.

While change is coming, the roles of data professionals are the main constants in the field.  Always needed and always accountable, these post holders in every organisation are the critical point at which good data protection and information governance practice either works or fails.  The law and guidance states what should happen.  The ICO is the body that takes action after failure.  However it is the data practitioner professionals at the live point of data management and protection who are the key element that needs to be properly resourced, trained, upskilled and valued in their organisations.

This conference examines what the new data legislation will mean and will require, the impact on the role of data protection professionals, data protection officers and other relevant staff in the field and the broader pressures and drivers of change for data management.  It will focus on three themes:

• New data protection laws – implications for professionals and compliance
• Data protection practitioners – where organisational data compliance succeeds or fails
• Current and emerging issues, prospective challenges and thinking beyond legislation and compliance

---

Topics to be discussed

---

• New data protection laws – implications for professionals and compliance
• The Data (Use and Access) Bill, GDPR and the data regulatory agenda ahead
• Data protection practitioners – where organisational data compliance succeeds or fails
• Scottish data protection professionals – current challenges and implications of the new law
• The organisational importance of investing in data protection practitioner skills and experience
• Current and emerging issues, prospective challenges and thinking beyond legislation and compliance
• Organisations and their data professionals – why centering them matters
• Regulating and complying in a world where data is stored and shared everywhere
• When data is everywhere and everyone is a data centre – what do we do now?

---

Who should attend

---

This conference is intended for all those working in the data protection/management and information governance fields and is for both organisations and individuals alike.  It is relevant to public, private and third sector organisations which hold, process, manage or share personal data and is for data practitioner professionals, accountable persons, data protection officers and also for those in executive and non-executive roles with a responsibility for legal compliance, reputation management, corporate accountability or strategic leadership.

Speakers