Data (Use and Access) Act
In force United Kingdom · In force Aug 20, 2025 · next deadline Sep 30, 2026 (in 4 days)
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Amends the UK GDPR, DPA 2018 and PECR (recognised legitimate interests, relaxed automated decision-making rules, reasonable-and-proportionate DSAR searches, new transfer test, cookie exemptions, PECR fines raised to UK GDPR levels), creates Smart Data schemes and digital verification services, and replaces the ICO with an Information Commission. Commenced in stages from August 2025 to 2026.
- Who it applies to
- All organisations subject to UK GDPR / PECR; Smart Data provisions apply to sectors designated by regulations; digital verification services providers.
- Penalties
- PECR fines raised to UK GDPR levels (up to GBP 17.5 million or 4% of worldwide annual turnover).
- Enforced by
- Information Commissioner's Office / Information Commission; DSIT for Smart Data and digital verification
- Official name
- Data (Use and Access) Act 2025
- Citation
- 2025 c. 18
- Topics
- privacy, data-access, ai
Research notes
Stage 2 (digital verification services, retention of data on a child's death) was planned for roughly 3-4 months after Royal Assent (autumn 2025); exact date not verified so omitted. Further Stage 4 items (e.g. National Underground Asset Register, births/deaths registration) commence on separate dates not all verified.
Related
Questions about Data (Use and Access) Act
- What are the Data (Use and Access) Act compliance deadlines?
- Jun 19, 2025: Royal Assent. Aug 20, 2025: Stage 1 commencement. Feb 5, 2026: Stage 3: main data protection changes commence. Jun 19, 2026: Mandatory data protection complaints procedure. Sep 30, 2026: ICO abolished; Information Commission takes over.
- When does Data (Use and Access) Act take effect?
- Data (Use and Access) Act took effect on Aug 20, 2025. The next milestone is Sep 30, 2026: ICO abolished; Information Commission takes over.
- Who does Data (Use and Access) Act apply to?
- All organisations subject to UK GDPR / PECR; Smart Data provisions apply to sectors designated by regulations; digital verification services providers.
- What are the penalties under Data (Use and Access) Act?
- PECR fines raised to UK GDPR levels (up to GBP 17.5 million or 4% of worldwide annual turnover).