The Data (Use and Access) Act 2025 became law in the UK in June 2025. It changes how data can be used, shared, protected and accessed. The law is broad, but it is especially important for social care providers because care services handle large amounts of personal and sensitive information every day.

Social care providers collect and use information about people’s health, care needs, medication, risks, family contacts, staff, finances and daily support. This means providers must be careful, lawful and clear about how they handle data. The Act is intended to make data sharing easier where it is needed, while still keeping people’s information safe.

What the Act is trying to do

Simply, the Act aims to help organisations use data in a more joined-up and useful way. It supports safer data sharing, better digital systems and clearer rules for organisations that use personal information.

For social care, the most important aim is to improve how care information moves between services, such as care homes, home care agencies, hospitals, GPs, local authorities and NHS systems. Better data sharing should help people receive safer and more coordinated care.

Main impacts for social care providers

Digital systems will need to meet information standards

One of the biggest changes is that information standards for health and adult social care systems will become more important. These standards govern how digital systems record, process and share information.

This means social care providers may need to check their digital care planning software, electronic medication administration records, rostering systems and other digital tools can share information properly with other health and care systems. Providers may also need to speak to their software suppliers about future compliance.

Data sharing should become easier, but must still be safe

The Act supports better data sharing where this helps public services and people receiving care. In social care, this could help with hospital discharge, medication changes, safeguarding, emergency planning and care reviews.

Easier sharing does not mean careless sharing; providers must still follow data protection law. They must only share information when there is a proper reason, share only what is needed, and make sure the information is sent securely.

Providers must keep strong data protection arrangements

The Act makes changes to UK data protection rules. Social care providers will still need clear policies, staff training and good records about how personal data is used. They should be able to explain what data they collect, why they collect it, how long they keep it and who they share it with.

Providers should also make sure they have a clear process for dealing with data protection complaints. People who use services, relatives and staff should know how to raise concerns if they think their information has been mishandled.

Subject access requests may need closer management

People have the right to ask for copies of their personal information; subject access requests. Social care providers already deal with these requests, but the Act makes it important to have a clear and reliable process.

Care records often include information about several people, such as relatives, staff, other residents or professionals. Providers must review, and where necessary redact, records carefully before sharing them, so they do not wrongly disclose information about someone else.

Cyber security becomes even more important

As care services use more digital systems, the risk of cyber incidents increases. A cyber incident could stop staff accessing care plans, medication records or contact details. It could also expose sensitive information.

Providers should keep basic cyber controls in place. This includes strong passwords, multi-factor authentication where possible, regular staff training, secure backups, role-based access controls and a plan for what to do if systems fail.

Staff will need simple and regular training

The Act does not remove the need for good judgement by staff. Care workers, managers, administrators and agency staff all need to understand the basics of data protection and safe sharing.
Training should use clear examples from daily care work. For example, staff should know when they can share information with a district nurse, how to check someone’s identity on the phone, and what to do if they send information to the wrong person.

Practical steps providers should take

• Review current digital care systems and ask suppliers how they will meet new information standards.
• Update data protection policies so they reflect the Act and current ICO guidance.
• Check that privacy notices are clear and easy for people to understand.
• Make sure there is a clear process for subject access requests and data protection complaints.
• Review data sharing agreements with local authorities, NHS bodies and partner organisations.
• Keep using recognised tools and frameworks, such as the Data Security and Protection Toolkit where relevant.
• Train staff regularly using simple examples from real care settings.
• Check cyber security arrangements, including backups, passwords, access permissions and incident response plans.

Benefits for people who use care services

If the Act is implemented well, Service Users should benefit from safer and more joined-up care. Important information should be available to the right people at the right time. This could reduce repeated questions, delays, mistakes and gaps in care.

For example, when someone leaves hospital and returns to a care home or receives home care, clear digital information about medicines, risks and care needs can help staff support them safely from the start.

Risks and challenges

Some providers may use older systems that do not easily connect with NHS or local authority systems. Smaller providers may need support to understand the technical requirements. Staff may worry about sharing information incorrectly, so policies and training must be practical and clear.

There is also a risk that organisations focus too much on technology and not enough on culture. Good data handling depends on people understanding their responsibilities, not just having the right software.

Summary

The Data (Use and Access) Act 2025 is an important step towards better use of data in the UK. For social care providers, the main impact is the move towards stronger information standards, safer data sharing and clearer data protection processes.

Providers should not wait until every detail is final before taking action. They can start now by reviewing systems, speaking to suppliers, updating training and strengthening cyber security. The goal is simple: use data in a way that supports safe, person-centred care while respecting people’s privacy and rights.

At Bettal we have policies covered for you, so that is one less thing for you to do.
If you have run a social care provider service and are looking for ongoing support with policies, procedures, browse our website or get in touch:

Email: info@bettal.co.uk
Telephone: 01697741411

Peter Ellis MA MSc BSc(Hons) RN
Consultant
Bettal Quality Consultancy