Data Governance Atlas UK edition

Data (Use and Access) Act 2025

Partially in force

The largest change to UK data protection law since 2018, and also a wider data Act. It does not replace the UK GDPR, the DPA 2018 or PECR: its data protection Part amends them in place, so its effect is read through those instruments. It adds recognised legitimate interests, recasts automated decision-making as Arts 22A to 22D, limits subject access to a reasonable and proportionate search, imposes a controller complaints duty, raises PECR penalties to UK GDPR levels and replaced the Information Commissioner with the Information Commission. The most misunderstood point is timing: it commenced in stages from Royal Assent on 2025-06-19 to 2026-09-30, and some provisions are still not commenced.

Identity

Citation
Data (Use and Access) Act 2025, c. 18
Jurisdiction
United Kingdom
Regime
Data protection
Applies to
England and Wales, Scotland, Northern Ireland
Type
Amending Act
Structure
8 Parts, 144 sections, 16 Schedules
Royal assent
2025-06-19

Staged. Royal Assent 2025-06-19 (s.78 and regulation-making powers in force under s.142). No. 1 (SI 2025/904) from 2025-08-20; No. 3 (SI 2025/996) for Parts 3 and 4 DPA amendments in autumn 2025; No. 6 (SI 2026/82) for most of Part 5 from 2026-02-05 and the complaints duty from 2026-06-19; No. 8 (SI 2026/317) for the Art 17(1)(g) erasure ground from 2026-03-31; No. 9 (SI 2026/1015) for the Information Commission from 2026-09-30. See the commencement tracker.

Amended by: An amending Act. Its effect is recorded on the commencement tracker and as track changes on the UK GDPR, DPA 2018 and PECR pages.

Reads together with

  • UK GDPR

    Most of Part 5 Chapter 1 amends the UK GDPR text directly.

  • Data Protection Act 2018

    Amends enforcement, complaints, Parts 3 and 4, and the regulator's constitution.

  • PECR 2003

    Part 5 Chapter 2 amends PECR: breach notification, cookies, charity marketing and enforcement.

Structure

What each Part or Chapter does, and the provisions worth knowing inside it. An orientation to the shape of the instrument, not a substitute for reading the official text.

Part 1: Access to customer data and business data (ss.1 to 26)

Smart data: powers to make regulations requiring data holders to share customer and business data with customers or authorised third parties.

  • s.19 Duty to review regulations made under the Part.
Part 2: Digital verification services (ss.27 to 55)

A trust framework and register for digital identity and attribute services.

  • s.31 Review of the trust framework.
  • s.53 Report on the operation of the Part.
Part 3: National Underground Asset Register (ss.56 to 60)

A register of underground infrastructure, with separate penalty schedules for England and Wales and for Northern Ireland.

  • Schs 1 and 2 Monetary penalties.
Part 4: Registers of births and deaths (ss.61 to 65)

Moves registers towards electronic form.

  • Sch 3 Consequential amendments.
Part 5: Data protection and privacy (ss.66 to 116)

Chapter 1 amends the UK GDPR and DPA 2018; Chapter 2 amends PECR.

  • s.67 Meaning of research and statistical purposes.
  • s.68 Consent to processing for scientific research.
  • s.70 and Sch 4 Recognised legitimate interests.
  • s.71 and Sch 5 Further processing treated as compatible.
  • s.76 Time limits for responding to requests.
  • s.78 Searches in response to data subjects' requests.
  • s.80 and Sch 6 Automated decision-making (Arts 22A to 22D).
  • s.81 Children's higher protection matters.
  • s.85 and Schs 7 to 9 International transfers.
  • s.86 Research safeguards.
  • s.98 Power to require a report.
  • s.100 Interview notices.
  • s.101 Penalty notices.
  • s.102 Annual report on regulatory action.
  • s.103 and Sch 10 Complaints by data subjects.
  • s.111 PECR breach notification.
  • s.112 and Sch 12 Storage and access exceptions.
  • s.114 Email marketing by charities.
  • s.115 and Sch 13 PECR enforcement powers.
Part 6: The Information Commission (ss.117 to 120)

Establishes the Information Commission, abolishes the office of Information Commissioner and transfers functions and property.

  • s.117 The Information Commission.
  • s.118 Abolition of the office of Information Commissioner.
  • s.119 Transfer of functions.
  • s.120 Transfer of property.
  • Sch 14 Constitution of the Commission.
Part 7: Other provision about use of, or access to, data (ss.121 to 138)

Health and adult social care information standards in England, online safety retention notices, reports on AI and copyright, and new intimate image offences.

  • s.121 and Sch 15 Information standards for health and adult social care in England.
  • s.124 Retention of information for child death investigations (Online Safety Act 2023).
  • ss.135 to 137 Economic impact assessment, report on copyright and AI, progress statement.
  • s.138 Offences of creating or requesting purported intimate images of adults.
Part 8: Final provisions (ss.139 to 144)

Extent, commencement and short title.

  • s.142 Commencement.

Asymmetry checklist

Ten questions every profile answers explicitly. "None found" means the point was examined and the instrument has nothing distinctive on it.

# Point Finding Notes
1 Territorial extent Asymmetry found Part 5 extends UK-wide, because data protection is reserved. Other Parts differ: the National Underground Asset Register has separate penalty regimes for England and Wales and for Northern Ireland, and the health and adult social care information standards apply in England only. Check the extent of the specific Part before relying on it.
2 Commencement Asymmetry found Staged over more than a year, by at least nine sets of commencement regulations. Some provisions took effect at Royal Assent, the main data protection tranche on 2026-02-05, the complaints duty on 2026-06-19 and the Information Commission on 2026-09-30. Part 5 has been fully in force since 2026-06-19.
3 Sunset / mandatory review Asymmetry found No sunset, but several review and reporting duties: review of smart data regulations (s.19), review of the trust framework (s.31), a report on Part 2 (s.53), analysis of the regulator's performance (s.95), an annual report on regulatory action (s.102), an economic impact assessment (s.135), a report on copyright and AI (s.136) and a progress statement (s.137).
4 Criminal liability Asymmetry found No new data protection offence: the DPA 2018 offences are unchanged and PECR breaches remain civil. Section 138 creates new offences of creating or requesting purported intimate images of adults without consent, outside this site's scope. NUAR breaches are dealt with by monetary penalties, not offences.
5 Civil liability None found No new private right of action. The complaints duty (new DPA 2018 s.164A) is procedural and does not create a claim; Art 82 UK GDPR and s.168 DPA 2018 compensation are unchanged.
6 Regulatory enforcement toolkit Asymmetry found Strengthens the toolkit: interview notices (s.100), a power to require technical reports (s.98), changes to penalty notice procedure (s.101), an annual report on regulatory action (s.102), and PECR brought into the DPA 2018 toolkit with penalties up to the higher of £17.5m or 4% of turnover (s.115, Sch 13).
7 Personal / director liability None found No new personal liability for directors or officers. DPA 2018 s.198 and its consent, connivance or neglect test are unchanged.
8 Public vs private sector split Asymmetry found No public and private split in Part 5, but public authorities cannot rely on recognised legitimate interests or legitimate interests for processing in performance of their tasks, and Parts 3 and 4 of the DPA 2018 (law enforcement and intelligence services) are amended separately by ss.79 and 88 to 90.
9 Legal-person coverage Asymmetry found Part 1 smart data covers business data as well as customer data, so legal persons' data is in scope there. Part 5 leaves data protection limited to living individuals.
10 Exemptions, with their conditions Asymmetry found Adds new permissions and limits rather than an exemption schedule: recognised legitimate interests (Annex 1), further processing treated as compatible (Annex 2), the reasonable and proportionate search limit on subject access, and research-related relaxations. Each has its own conditions, listed below.

Civil liability

No new civil route. The complaints duty is procedural; compensation still runs through Art 82 UK GDPR and s.168 DPA 2018.

Regulatory enforcement

Penalty ceiling
PECR penalties raised to the higher of £17.5m or 4% of worldwide turnover from 2026-02-05. UK GDPR ceilings unchanged.
  • Interview notice s.100

    Requires a person to attend and answer questions.

  • Power to require a report s.98

    Requires a technical report from an approved person.

  • Penalty notice changes s.101

    Changes to penalty notice procedure.

  • PECR enforcement s.115, Sch 13

    PECR enforced through the DPA 2018 toolkit.

Personal / director liability

Available
No

No new personal liability. DPA 2018 s.198 is unchanged.

Legal-person coverage

Covers legal persons
Yes

Part 1 business data covers legal persons; data protection itself remains about living individuals.

Public / private sector split

Separate regimes
No, one statute

One amending regime, with purpose-based differences carried through to Parts 3 and 4 of the DPA 2018.

  • Part 5 Chapter 1

    UK GDPR and DPA 2018 Part 2, general processing.

  • ss.79 and 88 to 90

    DPA 2018 Parts 3 and 4, law enforcement and intelligence services.

  • Part 5 Chapter 2

    PECR.

Exemptions

Recorded with their trigger conditions, not as bare names, most are conditional tests applied case by case rather than blanket carve-outs.

Annex 1 (s.70, Sch 4), Recognised legitimate interests

Trigger

Processing is lawful under Art 6(1)(ea) only if it is necessary for a condition listed in Annex 1, such as national security, emergencies, crime prevention or safeguarding. No balancing test. Not available to public authorities for processing in performance of their tasks.

Disapplies

  • Art 6(1)(f) balancing test, for listed purposes
Annex 2 (s.71, Sch 5), Further processing treated as compatible

Trigger

Further processing for a purpose listed in Annex 2 is treated as compatible with the original purpose, so no compatibility assessment is needed for those purposes.

Disapplies

  • Purpose limitation compatibility assessment, for listed purposes
Art 15(1A) (s.78), Reasonable and proportionate search

Trigger

The data subject is entitled only to what the controller can provide based on a reasonable and proportionate search. Treated as in force from 2024-01-01.

Disapplies

  • Unlimited search for subject access

Interactions and conflicts

The cross-instrument texture that profiling an Act in isolation misses, including where the real answer to a question about this Act is found in a different one.

Instrument Relationship Note
UK GDPR Cross-reference Amends the UK GDPR in place: lawful bases, purpose limitation, subject access, automated decisions, data protection by design and transfers.
Data Protection Act 2018 Cross-reference Amends the DPA 2018 in place: complaints, enforcement powers, Parts 3 and 4, and the regulator.
PECR 2003 Cross-reference Amends PECR in place: breach notification, storage and access, charity marketing and enforcement.

Questions answered

The questions this instrument most often raises, with the answer and the authority for it.

Tools, maps and checklists for this instrument

Explainers

Regulators, tribunals and prosecutors

  • Information CommissionUK-wide regulator for data protection and PECR, and for FOIA 2000 and EIR 2004. Succeeded the Information Commissioner on 2026-09-30.

On the horizon

Sources

Updated