Data (Use and Access) Act 2025: Every Data Protection Change, Dated

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. It did not change UK data protection law in one go: the government has switched its provisions on in stages, through nine sets of commencement regulations, and the last data protection step took effect on 30 September 2026. This guide lists every change that matters to a business, with the date it started to apply and the instrument that started it, so you can check your own position against the law rather than against a summary.

19 June 2025 — Royal Assent

A short list of provisions applied from the day the Act was passed (section 142(2)). The one that matters to most organisations is section 78: when someone makes a subject access request, the controller is required to carry out searches that are reasonable and proportionate, and no more. The ICO has rewritten its right of access guidance to match.

20 August 2025 — Commencement No. 1 (SI 2025/904)

Mostly machinery, but two items are practical. Section 111 changed the time periods for notifying the Commissioner of a personal data breach under the Privacy and Electronic Communications Regulations (PECR), which apply to communications providers. Section 117 and Schedule 14 created the constitution of the new Information Commission; the body itself took over a year later (see 30 September 2026). Section 74 gave the Secretary of State a power to add conditions for processing special category data by regulations; nothing changed on that day for controllers.

5 February 2026 — Commencement No. 6 (SI 2026/82): the main changes

This is the date the substance arrived. Taking the sections in the order the Act lists them:

• Recognised legitimate interests (section 70 and Schedule 4). A new lawful basis for a fixed list of purposes — including national security, public security and defence, responding to emergencies, detecting or preventing crime, and safeguarding vulnerable individuals — where, in the ICO’s words, the Act “removes the need for you to balance the impact on the people whose personal information you use.” Ordinary legitimate interests still need the balancing test; the Act also writes examples of such interests, including direct marketing, into the UK GDPR itself.
• Purpose limitation (section 71 and Schedule 5). A list of further uses that are treated as compatible with the original purpose, so no compatibility assessment is needed for them.
• Time limits for rights requests (section 76). The one-month period for answering a request is now defined as an “applicable time period” that begins only once the controller has what it reasonably needs to confirm the requester’s identity or to identify the information sought. The extension for complex or numerous requests remains. Requests received before 5 February 2026 stay under the old rules.
• Information to data subjects for research (section 77). Where providing a privacy notice to people whose data is used for research would involve disproportionate effort, it can be published instead, provided rights are protected.
• Automated decision-making (section 80 and Schedule 6). Article 22 of the UK GDPR is replaced by Articles 22A to 22D. A decision based solely on automated processing that has legal or similarly significant effects may now be taken on any lawful basis, provided safeguards are in place — information about the decision, a route to make representations, to obtain human intervention and to contest the decision. Decisions based on special category data remain confined to narrow conditions, such as explicit consent. Decisions taken before 5 February 2026 are governed by the previous rules.
• Children (section 81). Providers of online services likely to be accessed by children must take their needs into account when deciding how to design their processing. The ICO says that conforming to its Age appropriate design code should already satisfy this.
• International transfers (section 85 and Schedules 7 to 9). The test for transferring personal data outside the UK is reworded as a “data protection test”. The ICO’s position is that this does not materially change what you may do.
• Cookies and similar technologies (section 112 and Schedule 12). PECR now lists purposes for which information may be stored on, or read from, a user’s device without consent, such as collecting statistical information to improve the service and remembering a user’s appearance or functionality preferences, each subject to conditions. Tracking for advertising still needs consent.
• Charities (section 114). The email “soft opt-in” that commercial organisations have always had is extended to charities, for people who have expressed an interest in or supported their work.
• PECR enforcement (section 115 and Schedule 13). The Commissioner’s investigatory and enforcement powers under PECR are brought into line with the UK GDPR, including the level of penalties. Conduct before 5 February 2026 is dealt with under the old regime.
• The regulator’s toolkit (sections 94 and 98 to 101). The Commissioner may refuse manifestly unfounded or excessive requests made to it, require a report from an approved person, issue interview notices, and use a revised penalty notice procedure. The ICO says it will reserve the new powers for the most serious cases.

19 June 2026 — the complaints duty (section 103 and Schedule 10)

Every controller must now facilitate complaints from data subjects about its use of their data: provide a means to complain, acknowledge the complaint within 30 days, and respond without undue delay. The duty applies to complaints received on or after 19 June 2026. The ICO suggests an electronic complaints form as one way to meet it. A complaint handled badly here is the natural route to a complaint to the regulator.

30 September 2026 — the Information Commission (sections 118 and 119, SI 2026/1015)

The office of Information Commissioner was abolished and its functions transferred to the Information Commission, a body corporate with a board. Anything done by or to the Commissioner before that date is treated as done by or to the Commission, so existing notices, investigations and proceedings carry on. References in your documents are read as references to the Commission by law; the regulator is still known publicly as the ICO. Our note on the transition covers what, if anything, to change in your privacy notices.

What is still to come

The data protection provisions are complete: the ICO’s own page for organisations, updated on 19 June 2026, says all of them are in force, and the Information Commission followed on 30 September. The Act’s other parts — smart data schemes, digital verification services, the register of underground assets and the rest — have their own commencement timetable and do not change your data protection obligations.

What to check now

1. Your complaints route: is there a published way to complain, and a 30-day acknowledgement in practice?
2. Your subject access procedure: searches scoped to what is reasonable and proportionate; the clock handled correctly when you ask for ID or clarification.
3. Any decision taken wholly by a system about a person — pricing, eligibility, account suspension: which lawful basis, and which of the Article 22A to 22D safeguards are in place.
4. Your cookie banner against the new no-consent purposes, and your marketing lists against the PECR penalty regime.
5. Where you rely on legitimate interests: whether the purpose is on the recognised list (no balancing test) or an ordinary one (balancing test and record).
6. Transfer assessments: updated to the data protection test wording.

If you would rather have this checked against your own documents, our GDPR audits and gap analyses do exactly that, provision by provision.