The UK's Smart Data Strategy and the future of customer data enrichment

For the last decade, "customer data" in the UK has meant whatever a business could gather about its own customers plus whatever it could buy from a handful of brokers. That settlement is now being rewritten in law. In March 2026 the government published its Smart Data 2035 strategy, backed by at least £36 million of Industrial Strategy investment, setting a target of five or more active smart data schemes by 2030 and twenty or more by 2035. It rests on the Data (Use and Access) Act 2025, whose principal provisions took effect in February 2026 and which gives ministers the legal power to compel firms in almost any sector to share customer and business data with authorised third parties. For anyone whose work depends on understanding customers, this is one of the most consequential regulatory shifts since GDPR — and it changes the calculus around where enrichment data comes from.

What the Smart Data Strategy actually sets in motion

Smart data is, at its core, the secure and consented sharing of a customer's or business's data with authorised third parties — the model that Open Banking pioneered, now generalised across the economy. Under a scheme, a customer can require their provider to hand over the data they generate, either as a download or streamed directly to a third party of their choosing. The Smart Data 2035 roadmap names a long list of candidate sectors, and the government has already signalled where momentum is building:

• Energy and Open Finance — the front-runners, with energy schemes aimed at letting households and businesses share consumption data to drive switching, price comparison, and low-carbon advice.
• Retail — a call for evidence has been issued to assess a scheme reaching beyond the online grocery segment.
• Financial services, road fuels, property, transport, telecoms, digital markets and agrifood — all named as candidates for consultation over the coming years.

A cross-sector Guidebook, due in early 2027, will set binding best-practice standards for how these schemes operate. The direction of travel is unmistakable: over the next decade, a growing share of the customer data that businesses once had to buy or infer will instead flow — with the customer's permission — through standardised, interoperable pipes.

The Data (Use and Access) Act: the legal engine underneath

Smart data schemes need a statutory foundation, and the Data (Use and Access) Act 2025 provides it. Enacted on 19 June 2025, with its principal data-protection provisions coming into force on 5 February 2026, the Act does more than enable data sharing. It also recalibrates parts of the UK GDPR: it introduces a set of "recognised legitimate interests" — including crime prevention, safeguarding, and responding to emergencies — that can be relied on without the usual balancing test, and it tightens complaint-handling duties, with a requirement to acknowledge data-protection complaints within 30 days taking effect on 19 June 2026. The Act is deliberately pro-sharing and pro-innovation, but it does not loosen the fundamentals of personal-data processing. Consent, lawful basis, purpose limitation, and data-subject rights all still apply — and in a smart data scheme, the customer's consent is the switch that turns the flow on or off.

Where consented smart data reaches its limits

A world of portable, permissioned data is genuinely good news for customers and for the businesses they choose to share with. But consent-gated data has structural limits that no roadmap can legislate away, and enrichment strategies built solely on it will hit them quickly. Only a fraction of customers will opt in to any given scheme, so coverage is partial and self-selecting by design. Schemes arrive sector by sector over a decade, which means most categories will have no live scheme for years. There is a cold-start problem for every new prospect — you cannot enrich someone from smart data before they have consented and connected an account. And the moment a customer withdraws consent, the data flow stops. Smart data tells you a great deal about the customers who opt in, and nothing about everyone else. For acquisition, market sizing, and reaching people you do not yet have a relationship with, that is a serious gap.

Area-level geodemographics: the always-on context layer

This is where privacy-safe, area-level data earns its place in a modern data stack. Because Cogstrata describes neighbourhoods rather than named individuals, its data carries none of the consent friction that governs personal data — it is GDPR-safe precisely because it never touches personal information. That makes it available for every postcode in the country, all the time, with no opt-in required and no cold-start gap. It complements smart data rather than competing with it:

• Universal coverage — every UK postcode carries a geodemographic profile, so you can enrich prospects and non-consenting customers alike, not just the opted-in minority.
• Context for the feeds you do receive — a stream of energy or transaction data is far more interpretable when set against the demographic and economic character of the neighbourhood it comes from.
• Continuous refresh — with 5,000+ derived attributes and 24 groups refreshed continuously, the picture stays current, unlike the annual or biennial cycles of legacy providers such as CACI Acorn and Experian Mosaic.
• Delivery that fits the pipes — available by API, batch, or marketplace, and structured so both human teams and AI agents can consume it.

As permissioned pipes proliferate, the value of a stable, universal reference layer goes up, not down — something to interpret the flows against and to fall back on wherever consent is absent. For more on why the privacy-safe approach compounds over time, see Postcode-level intelligence: why the privacy-safe approach wins in the long run.

How to prepare: a two-layer data strategy

The businesses that get the most from the next decade will not treat smart data and area-level enrichment as an either/or. They will run them as two layers of one strategy: a permissioned layer that goes deep on the customers who opt in, and a privacy-safe context layer that spans everyone else and gives the permissioned data meaning. Watch the sector consultations that matter to you — energy, finance, retail — and plan for the schemes as they land, but do not wait a decade for coverage you can have today. Ground your acquisition, segmentation, and modelling in a live, current, defensible picture of UK neighbourhoods now, and let each smart data scheme enrich that foundation as it arrives. The regulatory groundwork has been laid; the advantage will go to the teams that build on both layers at once.