Jurisdiction

United Kingdom: data, AI and cyber laws

Regulations

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

Data (Use and Access) ActAmends the UK GDPR, DPA 2018 and PECR (recognised legitimate interests, relaxed automated decision-making rules, reasonable-and-proportionate DSAR searches, new transfer test, cookie exemptions, PECR fines raised to UK GDPR levels), creates Smart Data schemes and digital verification services, and replaces the ICO with an Information Commission. Commenced in stages from August 2025 to 2026.In effect since Aug 20, 2025

Proposed

UK Cyber Security and Resilience BillUpdates the NIS Regulations 2018: brings managed service providers and data centres into scope, lets regulators designate critical suppliers, tightens incident reporting (initial notice within 24 hours, full report within 72 hours) and strengthens regulator powers. Substantive duties will follow via secondary legislation after Royal Assent.No date set

Amended

UK Data Protection Act 2018Core UK data protection statute that sits alongside the UK GDPR. It sets exemptions and conditions for special category and criminal offence data, the law enforcement and intelligence services regimes, and the regulator's powers and fines. It has been substantially amended by the Data (Use and Access) Act 2025.In effect since May 25, 2018

Amended

UK GDPRThe UK's core data protection regime: lawful bases, transparency, data subject rights, security, breach notification within 72 hours, and international transfer rules. Retained EU GDPR became the UK GDPR from 1 January 2021 and was materially amended by the Data (Use and Access) Act 2025 from 5 February 2026.In effect since May 25, 2018

Enacted

UK Investigatory Powers (Amendment) Act 2024Amends the Investigatory Powers Act 2016. It creates a lighter regime for intelligence agencies to hold bulk personal datasets with low or no expectation of privacy, widens communications data rules, and bars telecoms operators from making relevant changes to their services that would weaken lawful access capabilities while a retention notice is under review.No date set

In force

UK Online Safety ActImposes duties of care on user-to-user services and search engines to assess and mitigate illegal content risks and, where children can access the service, to protect children (including highly effective age assurance for pornography and other primary priority content). Categorised services face additional transparency, user empowerment and fraudulent advertising duties.In effect since Mar 17, 2025

In force

UK PSTI Act (product security)Sets baseline security requirements for consumer connectable products sold in the UK. Manufacturers must ban universal default passwords, publish a way to report vulnerabilities, and state the minimum security update support period. Importers and distributors share compliance duties.In effect since Apr 29, 2024

In force

UK Telecommunications Security ActImposes strengthened security duties on UK public telecoms providers, backed by detailed security measures regulations and a code of practice. It also gives the government powers to restrict the use of high-risk vendors' equipment through designated vendor directions.In effect since Oct 1, 2022

Past deadlines

MilestoneTentativeOct 26 · yesterday

UK Cyber Security and Resilience BillLords report stage scheduledHouse of Lords report stage scheduled (committee stage sat 1, 3 and 7 Sept 2026).United Kingdom

Takes effectSep 30 · 27 days ago

Data (Use and Access) ActICO abolished; Information Commission takes overSections 118-119 commence: office of Information Commissioner abolished and functions transferred to the Information Commission (Commencement No. 9 Regulations 2026).United Kingdom

ComplianceJun 19 · 4 months ago

Data (Use and Access) ActMandatory data protection complaints procedureControllers must have a process for data subject complaints (s.103 and Sch. 10), per Commencement No. 6 Regulations 2026, reg. 3.United Kingdom

MilestoneJun 16 · 4 months ago

UK Cyber Security and Resilience BillPasses House of CommonsReport stage and third reading completed in the Commons after carry-over into the new session.United Kingdom

ReportingApr 11 · 7 months ago

UK Online Safety ActFee notification window closes (2026/27)Fee-liable providers must notify Ofcom before the notification window for the first charging year closes.United Kingdom

Takes effectFeb 5 · 9 months ago

UK GDPRDUAA amendments to UK GDPR commenceMain Data (Use and Access) Act 2025 Part 5 amendments (recognised legitimate interests, ADM, DSAR, transfers, cookies, PECR fines) apply.United Kingdom

Takes effectFeb 5 · 9 months ago

Data (Use and Access) ActStage 3: main data protection changes commenceRecognised legitimate interests, ADM reforms, DSAR changes, international transfer test, cookie exemptions and PECR fines at UK GDPR levels apply (Commencement No. 6 Regulations 2026, reg. 2).United Kingdom

MilestoneNov 12, 2025 · 11 months ago

UK Cyber Security and Resilience BillIntroduced (Commons first reading)Bill introduced in the House of Commons.United Kingdom

Takes effectAug 20, 2025 · 14 months ago

Data (Use and Access) ActStage 1 commencementTechnical data protection provisions, ICO statutory objects, Smart Data framework (Part 1) and AI/copyright reporting duties commence (Commencement No. 1 Regulations 2025).United Kingdom

Takes effectJul 25, 2025 · 15 months ago

UK Online Safety ActProtection of children duties applyChildren's safety duties and Protection of Children Codes take effect, including highly effective age assurance; children's risk assessments due by 24 July 2025.United Kingdom

MilestoneJun 19, 2025 · 16 months ago

Data (Use and Access) ActRoyal AssentThe Act receives Royal Assent; commencement staged by regulations.United Kingdom

ComplianceApr 16, 2025 · 18 months ago

UK Online Safety ActChildren's access assessments dueServices had to complete children's access assessments to determine whether children are likely to access them.United Kingdom

Takes effectMar 17, 2025 · 19 months ago

UK Online Safety ActIllegal harms duties enforceableIllegal content safety duties apply; illegal content risk assessments had to be completed by 16 March 2025.United Kingdom

ComplianceApr 29, 2024 · 2.5 years ago

UK PSTI Act (product security)Product security requirements applySecurity requirements regulations (SI 2023/1007) come into force.United Kingdom

MilestoneApr 25, 2024 · 2.5 years ago

UK Investigatory Powers (Amendment) Act 2024Royal AssentInvestigatory Powers (Amendment) Act 2024 receives Royal Assent.United Kingdom

MilestoneOct 26, 2023 · 3 years ago

UK Online Safety ActRoyal AssentThe Online Safety Act receives Royal Assent.United Kingdom

MilestoneDec 6, 2022 · 3.9 years ago

UK PSTI Act (product security)Royal AssentPSTI Act receives Royal Assent.United Kingdom

ComplianceOct 1, 2022 · 4.1 years ago

UK Telecommunications Security ActSecurity measures regulations in forceElectronic Communications (Security Measures) Regulations 2022 come into force.United Kingdom

MilestoneNov 17, 2021 · 4.9 years ago

UK Telecommunications Security ActRoyal AssentTelecommunications (Security) Act receives Royal Assent.United Kingdom

Takes effectJan 1, 2021 · 5.8 years ago

UK GDPRUK GDPR takes effect after Brexit transitionRetained EU GDPR becomes the UK GDPR at the end of the Brexit implementation period.United Kingdom

Takes effectJul 23, 2018 · 8.3 years ago

UK Data Protection Act 2018Age appropriate design code powers commenceSection 123 (age-appropriate design code) comes into force.United Kingdom

Takes effectMay 25, 2018 · 8.4 years ago

UK GDPRData Protection Act 2018 and GDPR applyDPA 2018 and EU GDPR began applying in the UK.United Kingdom

Takes effectMay 25, 2018 · 8.4 years ago

UK Data Protection Act 2018Main provisions commenceMost provisions come into force under SI 2018/625.United Kingdom

MilestoneMay 23, 2018 · 8.4 years ago

UK Data Protection Act 2018Royal AssentData Protection Act 2018 receives Royal Assent.United Kingdom