Regulationsby GlyphData (Use and Access) Act
In force United Kingdom · In force Aug 20, 2025 · no upcoming deadlines
Deadlines
ICO abolished; Information Commission takes overSections 118-119 commence: office of Information Commissioner abolished and functions transferred to the Information Commission (Commencement No. 9 Regulations 2026).
Mandatory data protection complaints procedureControllers must have a process for data subject complaints (s.103 and Sch. 10), per Commencement No. 6 Regulations 2026, reg. 3.
Stage 3: main data protection changes commenceRecognised legitimate interests, ADM reforms, DSAR changes, international transfer test, cookie exemptions and PECR fines at UK GDPR levels apply (Commencement No. 6 Regulations 2026, reg. 2).
Stage 1 commencementTechnical data protection provisions, ICO statutory objects, Smart Data framework (Part 1) and AI/copyright reporting duties commence (Commencement No. 1 Regulations 2025).
Royal AssentThe Act receives Royal Assent; commencement staged by regulations.
Summaries for reference, not legal advice. Check the official text.
What it does
Amends the UK GDPR, DPA 2018 and PECR (recognised legitimate interests, relaxed automated decision-making rules, reasonable-and-proportionate DSAR searches, new transfer test, cookie exemptions, PECR fines raised to UK GDPR levels), creates Smart Data schemes and digital verification services, and replaces the ICO with an Information Commission. Commenced in stages from August 2025 to 2026.
- Who it applies to
- All organisations subject to UK GDPR / PECR; Smart Data provisions apply to sectors designated by regulations; digital verification services providers.
- Penalties
- PECR fines raised to UK GDPR levels (up to GBP 17.5 million or 4% of worldwide annual turnover).
- Enforced by
- Information Commissioner's Office / Information Commission; DSIT for Smart Data and digital verification
- Official name
- Data (Use and Access) Act 2025
- Citation
- 2025 c. 18
- Topics
- Privacy, Data access and sharing, AI
Research notes
Stage 2 (digital verification services, retention of data on a child's death) was planned for roughly 3-4 months after Royal Assent (autumn 2025); exact date not verified so omitted. Further Stage 4 items (e.g. National Underground Asset Register, births/deaths registration) commence on separate dates not all verified.
Related
CoE AI Framework ConventionFirst binding international treaty on AI. Parties must ensure AI activities across the lifecycle respect human rights, democracy and the rule of law, with risk and impact assessments, transparency, oversight and remedies. Each party chooses how to apply it to private actors.No date set
Swiss revised FADP (nFADP)Switzerland's modernised data protection law, closely aligned to GDPR: privacy by design/default, records of processing, DPIAs, breach notification to the FDPIC as soon as possible, and cross-border transfer rules. Protects only natural persons' data.In effect since Sep 1, 2023
Turkey KVKKTurkey's general data protection law. The 2024 amendments reworked sensitive-data processing and replaced the consent-first cross-border transfer rule with a GDPR-style tiered regime (adequacy, appropriate safeguards such as standard contracts that must be notified to the Authority within 5 business days, then limited derogations).In effect since Apr 7, 2016
UK Cyber Security and Resilience BillUpdates the NIS Regulations 2018: brings managed service providers and data centres into scope, lets regulators designate critical suppliers, tightens incident reporting (initial notice within 24 hours, full report within 72 hours) and strengthens regulator powers. Substantive duties will follow via secondary legislation after Royal Assent.No date setUK Data Protection Act 2018Core UK data protection statute that sits alongside the UK GDPR. It sets exemptions and conditions for special category and criminal offence data, the law enforcement and intelligence services regimes, and the regulator's powers and fines. It has been substantially amended by the Data (Use and Access) Act 2025.In effect since May 25, 2018UK GDPRThe UK's core data protection regime: lawful bases, transparency, data subject rights, security, breach notification within 72 hours, and international transfer rules. Retained EU GDPR became the UK GDPR from 1 January 2021 and was materially amended by the Data (Use and Access) Act 2025 from 5 February 2026.In effect since May 25, 2018UK Investigatory Powers (Amendment) Act 2024Amends the Investigatory Powers Act 2016. It creates a lighter regime for intelligence agencies to hold bulk personal datasets with low or no expectation of privacy, widens communications data rules, and bars telecoms operators from making relevant changes to their services that would weaken lawful access capabilities while a retention notice is under review.No date setUK Online Safety ActImposes duties of care on user-to-user services and search engines to assess and mitigate illegal content risks and, where children can access the service, to protect children (including highly effective age assurance for pornography and other primary priority content). Categorised services face additional transparency, user empowerment and fraudulent advertising duties.In effect since Mar 17, 2025
Questions about Data (Use and Access) Act
- What are the Data (Use and Access) Act compliance deadlines?
- Jun 19, 2025: Royal Assent. Aug 20, 2025: Stage 1 commencement. Feb 5, 2026: Stage 3: main data protection changes commence. Jun 19, 2026: Mandatory data protection complaints procedure. Sep 30, 2026: ICO abolished; Information Commission takes over.
- When does Data (Use and Access) Act take effect?
- Data (Use and Access) Act took effect on Aug 20, 2025.
- Who does Data (Use and Access) Act apply to?
- All organisations subject to UK GDPR / PECR; Smart Data provisions apply to sectors designated by regulations; digital verification services providers.
- What are the penalties under Data (Use and Access) Act?
- PECR fines raised to UK GDPR levels (up to GBP 17.5 million or 4% of worldwide annual turnover).