DUAA 2025 commencement

The Data (Use and Access) Act 2025 took effect in stages, so "the DUAA changed X" only helps once you know when X took effect. 22 changes across 7 commencement dates, all in force. Each one names the section, what it amends and the regulations that commenced it.

1. 2025-06-19

   • Subject access limited to what a reasonable and proportionate search can find

     Section

     s.78

     Amends

     UK GDPR Art 15 (new para 1A); DPA 2018 ss.45 and 94

     Regime

     Data protection

     Commenced by

     Royal Assent (s.142(2)(b))

     Section 78(5) treats the amendments as having come into force on 2024-01-01, so the standard applies to requests handled from that date, not only to new requests.

     Sources: Data (Use and Access) Act 2025, section 78

2. 2025-08-20

   • PECR breach notification aligned with the UK GDPR (72 hours, not 24)

     Section

     s.111

     Amends

     PECR reg 5A

     Regime

     Electronic communications

     Commenced by

     Data (Use and Access) Act 2025 (Commencement No. 1) Regulations 2025 (SI 2025/904)

     Providers now notify the regulator within 72 hours of becoming aware of the essential facts of the breach. Subscriber notification without unnecessary delay where the breach is likely to adversely affect their personal data or privacy is unchanged.

     Sources: Security breaches (Guide to PECR); Data (Use and Access) Act 2025, plans for commencement

3. 2025-11-17

   • Legal professional privilege and national security amendments to Parts 3 and 4 DPA 2018

     Section

     ss.79, 88, 89 and 90

     Amends

     DPA 2018 Parts 3 and 4

     Regime

     Data protection

     Commenced by

     Data (Use and Access) Act 2025 (Commencement No. 3 and Transitional and Saving Provisions) Regulations 2025 (SI 2025/996)

     Commenced in two stages. Section 79 (legal professional privilege) and section 88 (national security exemption) came into force on 2025-09-05; sections 89 and 90 (joint processing by intelligence services and competent authorities) on 2025-11-17.

     Sources: Data (Use and Access) Act 2025 (Commencement No. 3 and Transitional and Saving Provisions) Regulations 2025 (SI 2025/996); Data (Use and Access) Act 2025, plans for commencement

4. 2026-02-05

   • Statutory meaning of research and statistical purposes, including commercial research

     Section

     s.67

     Amends

     UK GDPR definitions

     Regime

     Data protection

     Commenced by

     SI 2026/82, reg 2(a)

     Sources: Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82)

   • Consent to processing for an area of scientific research

     Section

     s.68

     Amends

     UK GDPR consent provisions (consent to an area of research)

     Regime

     Data protection

     Commenced by

     SI 2026/82, reg 2(b)

     Sources: Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82)

   • Recognised legitimate interests, a lawful basis with no balancing test for listed purposes

     Section

     s.70, Sch 4

     Amends

     UK GDPR Art 6 and new Annex 1

     Regime

     Data protection

     Commenced by

     SI 2026/82, reg 2(c) and (z6)

     Sources: Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82)

   • Further processing treated as compatible with the original purpose in listed cases

     Section

     s.71, Sch 5

     Amends

     UK GDPR purpose limitation provisions

     Regime

     Data protection

     Commenced by

     SI 2026/82, reg 2(d) and (z7)

     Sources: Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82)

   • Time limits for responding to data subject requests, including stopping the clock

     Section

     s.76

     Amends

     UK GDPR and DPA 2018 time limits for responding to requests

     Regime

     Data protection

     Commenced by

     SI 2026/82, reg 2(h)

     Transitional: does not apply to requests received before 2026-02-05 (SI 2026/82 reg 4).

     Sources: Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82)

   • Changes to the information that must be given to data subjects

     Section

     s.77

     Amends

     UK GDPR Arts 13 and 14

     Regime

     Data protection

     Commenced by

     SI 2026/82, reg 2(i)

     Sources: Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82)

   • Automated decision-making recast as Arts 22A to 22D (safeguards model)

     Section

     s.80, Sch 6

     Amends

     UK GDPR Art 22 (replaced); DPA 2018 ss.14 and 50

     Regime

     Data protection

     Commenced by

     SI 2026/82, reg 2(j) and (z8)

     Transitional: does not apply to decisions taken before 2026-02-05 that were covered by the old Art 22(3), s.14 or s.50(2) safeguards (SI 2026/82 reg 5).

     Sources: Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82)

   • Data protection by design must account for children's higher protection matters

     Section

     s.81

     Amends

     UK GDPR Art 25

     Regime

     Data protection

     Commenced by

     SI 2026/82, reg 2(k)

     Sources: Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82)

   • International transfers reframed around the "data protection test"

     Section

     s.85, Schs 7 to 9

     Amends

     UK GDPR Chapter V; DPA 2018 Part 3 transfers

     Regime

     Data protection

     Commenced by

     SI 2026/82, reg 2(m) and (z9) to (z11)

     Sources: Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82)

   • Regulator's power to require a technical report

     Section

     s.98

     Amends

     DPA 2018 Part 6

     Regime

     Data protection

     Commenced by

     SI 2026/82, reg 2(q)

     Sources: Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82)

   • Interview notices, inserting DPA 2018 ss.148A to 148C

     Section

     s.100

     Amends

     DPA 2018 Part 6 (new ss.148A interview notices, 148B restrictions, 148C false statements)

     Regime

     Data protection

     Commenced by

     SI 2026/82, reg 2(s)

     Sources: Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82)

   • Changes to penalty notice procedure

     Section

     s.101

     Amends

     DPA 2018 s.155 and related provisions

     Regime

     Data protection

     Commenced by

     SI 2026/82, reg 2(t)

     Transitional: does not apply where a notice of intent was given before 2026-02-05 (SI 2026/82 reg 6).

     Sources: Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82)

   • Consent exceptions for low-risk storage and access (cookies), including analytics

     Section

     s.112, Sch 12

     Amends

     PECR reg 6

     Regime

     Electronic communications

     Commenced by

     SI 2026/82, reg 2(w) and (z13)

     Sources: Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82)

   • Email direct marketing by charities without prior consent, on conditions

     Section

     s.114

     Amends

     PECR reg 22

     Regime

     Electronic communications

     Commenced by

     SI 2026/82, reg 2(x)

     Sources: Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82)

   • PECR brought within the DPA 2018 enforcement toolkit; penalties raised to UK GDPR levels

     Section

     s.115, Sch 13

     Amends

     PECR enforcement provisions

     Regime

     Electronic communications

     Commenced by

     SI 2026/82, reg 2(y) and (z14)

     Transitional rules for investigations, audits and actions begun under the old regime are in SI 2026/82 regs 8 to 11.

     Sources: Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82)

   • Safeguards for research, archiving and statistical processing

     Section

     ss.86 and 87

     Amends

     UK GDPR research, archiving and statistics safeguards; DPA 2018

     Regime

     Data protection

     Commenced by

     SI 2026/82, reg 2(n) and (o)

     Sources: Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82)

5. 2026-03-31

   • New erasure ground for data processed because of an allegation by a "malicious person"

     Section

     Sch 11, para 32

     Amends

     UK GDPR Art 17 (new para 1(g))

     Regime

     Data protection

     Commenced by

     Victims and Prisoners Act 2024 (Commencement No. 10) and Data (Use and Access) Act 2025 (Commencement No. 8) Regulations 2026 (SI 2026/317)

     A "malicious person" is someone convicted of stalking or harassment against the data subject, or subject to a stalking protection order protecting them. In force from 2026-03-31, commenced together with the related Victims and Prisoners Act 2024 provision.

     Sources: Data (Use and Access) Act 2025 (Commencement No. 3 and Transitional and Saving Provisions) Regulations 2025 (SI 2025/996); Data (Use and Access) Act 2025, plans for commencement

6. 2026-06-19

   • Controllers must have a process for data protection complaints

     Section

     s.103, Sch 10

     Amends

     DPA 2018 (new s.164A)

     Regime

     Data protection

     Commenced by

     SI 2026/82, reg 3

     Transitional: the new s.164A(3) and (4) duties apply only to complaints received on or after 2026-06-19 (SI 2026/82 reg 7). The gov.uk commencement page does not list this change; the regulations themselves do, and they are the primary source.

     Sources: Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82)

7. 2026-09-30

   • Information Commissioner abolished; functions transferred to the Information Commission

     Section

     Part 6, ss.117 to 120

     Amends

     DPA 2018 Part 5

     Regime

     Data protection

     Commenced by

     Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/1015)

     The government stated that the transition does not change the regulator's role, responsibilities or powers. Paul Arnold is interim Chief Executive; recruitment for the Chair was ongoing at the announcement. The Commission is established by DUAA Part 6 (ss.117 to 120).

     Sources: Information Commission succeeds the ICO as UK's data protection regulator; Data (Use and Access) Act 2025, plans for commencement