Data (Use and Access) Act 2025: what changed, and since when

The Act: what it amends, and how it came into force

The Data (Use and Access) Act 2025 is an Act of Parliament that received Royal Assent on 19 June 2025, as the Department for Science, Innovation and Technology's Data Use and Access Act 2025: plans for commencement records. It does not create a new data protection regime. The ICO's The Data Use and Access Act 2025 (DUAA) – what does it mean for organisations? says “The DUAA amends, but does not replace, the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA) and the Privacy and Electronic Communications Regulations (PECR).” A school's, nursery's, charity's or care provider's data protection policy still rests on those three laws; what has changed is some of what they say.

Most of the Act did not start on the day it was passed. Section 142 of the Data (Use and Access) Act 2025 provides that, apart from a short list, “this Act comes into force on such day as the Secretary of State may by regulations appoint”. One provision on that short list matters to every organisation: section 78, which inserted Article 15(1A) into UK GDPR so that a subject access request reaches only what the controller can find in a reasonable and proportionate search. It came into force on Royal Assent, and the annotation to Article 15 of UK GDPR records it as inserted “retrospective to 1.1.2024”.

Everything else came through commencement regulations. The explanatory note to the latest, made on 4 November 2026, says “These are the 10th commencement regulations made under the 2025 Act.” The ICO's Data (Use and Access) Act 2025 hub page now says that all the provisions affecting data protection law and PECR are in force.

Most of the changes are options rather than new obligations. The ICO's summary puts it this way: “Most of the changes offer you an opportunity to do things differently, rather than needing you to make specific changes to comply with the law.” The changes that do require action are a data protection complaints process, a new item in every privacy notice, the subject access rules that now carry defined clocks, safeguards for any solely automated significant decision, and, for an online service likely to be used by children, the children's higher protection matters. Section 03 sets them out; section 04 covers the options.

Commencement: what came into force, when, and under which instrument

The Data (Use and Access) Act 2025 was commenced in stages between 19 June 2025 and 9 November 2026. These are the main dates, each with the statutory instrument that brought the change in; 5 February and 19 June 2026 are the two that change most of what schools, early years providers, charities and care providers do. The note at the end of the Data (Use and Access) Act 2025 (Commencement No. 10) Regulations 2026 lists every earlier commencement, including a few narrower ones not shown here.

• 19 June 2025, on Royal Assent (section 142(2)): section 78, the reasonable and proportionate search for subject access requests (UK GDPR Article 15(1A)), treated as in force from 1 January 2024.
• 20 August 2025, Commencement No. 1 (S.I. 2025/904): mainly provisions about the regulator and the machinery of the law: section 91 (duties of the Commissioner in carrying out functions), section 106 (protection of prohibitions, restrictions and data subject's rights), section 111 (duty to notify the Commissioner of personal data breach: time periods), most of section 117 and Schedule 14, which created the Information Commission ahead of the transfer. Part 1 (smart data), section 74 (the power to add special category conditions) and section 104 (court procedure for subject access cases) began the same day.
• 1 December 2025, Commencement No. 4 (S.I. 2025/1213): Part 2, digital verification services, “except sections 45 to 48”.
• 5 February 2026, Commencement No. 6 (S.I. 2026/82, regulation 2): the bulk of the data protection and privacy changes. Section 70 and Schedule 4 (recognised legitimate interests), section 71 and Schedule 5 (purpose limitation), section 76 (time limits for responding to data subjects' requests, the new Article 12A), section 77 (information to be provided to data subjects), section 80 (automated decision-making), section 81 (children's higher protection matters), section 85 (international transfers), section 112 and Schedule 12 (cookies and similar storage), section 114 (email marketing by charities), section 115 (PECR enforcement), and section 121 and Schedule 15 (information standards for health and adult social care in England). The government's commencement page says this instrument brings into force “the majority of the data protection and privacy provisions in Part 5 of DUAA on 5 February 2026.”
• 31 March 2026 (S.I. 2026/317, Commencement No. 8 for this Act): a new ground for erasure in Article 17(1)(g) of UK GDPR, for data processed because of an allegation by a “malicious person” that the controller has investigated and decided to take no further action on. The ground itself comes from section 31 of the Victims and Prisoners Act 2024, for England and Wales; paragraph 32 of Schedule 11 to the 2025 Act extended it to Scotland and Northern Ireland on the same day.
• 19 June 2026, Commencement No. 6 (S.I. 2026/82, regulation 3): section 103 and Schedule 10: the right to complain to the controller in the new section 164A of the Data Protection Act 2018, the matching new items in privacy notices and subject access responses, and the move of the right to complain to the regulator into section 165 of that Act.
• 30 September 2026, Commencement No. 9 (S.I. 2026/1015): section 118 abolished the office of Information Commissioner and section 119 transferred its functions to the Information Commission.
• 9 November 2026, Commencement No. 10 (S.I. 2026/1167): Part 4, sections 61 to 65, on the form in which registers of births and deaths are kept. Nothing in it changes a data protection duty.

Two transitional rules matter for anything already in progress. Regulation 4 of S.I. 2026/82 says the new time limits in section 76 do not apply to a request the controller received before 5 February 2026, so an older request runs on the old rules. Regulation 7 applies the duties to acknowledge and respond to a complaint “only in relation to a complaint that is received by the controller on or after the 19th June 2026.” Where guidance gives another date for the changes, the instruments above are the authority.

The main parts of the Act still not in force as at 10 November 2026 are these, and none of them touches data protection duties: sections 45 to 48 (public bodies sharing information with registered digital verification services), Part 3 (the National Underground Asset Register, in force only so far as needed to make regulations), and section 131 and most of section 133 (both on electronic trust services). The earlier-commencement table in Commencement No. 10 lists no section from Part 3 and none of sections 45 to 48.

What you must now do

Five changes need action. The first three apply to every controller, whatever its sector or size; the last two apply only where an organisation takes such decisions or runs such a service.

1. A data protection complaints process (from 19 June 2026). Under section 164A of the Data Protection Act 2018, a person may complain to the controller if they think its use of their personal data infringes the UK GDPR. The controller “must facilitate the making of complaints under this section by taking steps such as providing a complaint form which can be completed electronically and by other means”, must “acknowledge receipt of the complaint within the period of 30 days beginning when the complaint is received”, and must, “without undue delay”, take appropriate steps to respond and tell the complainant the outcome. A failure can bring an enforcement notice under section 149(5A) and a penalty under section 157(4A), where “the maximum amount of the penalty that may be imposed by a penalty notice is the standard maximum amount.” The data protection complaints procedure guide covers the process in full.
2. Privacy notices that name the new right (from 19 June 2026). Article 13(2)(ca) of UK GDPR adds “the right to make a complaint to the controller under section 164A of the 2018 Act” to what a privacy notice tells people; Article 14(2)(da) does the same where the data came from someone else, and Article 15(1)(ea) adds it to every subject access response. A notice last revised before June 2026 probably lacks it.
3. Subject access on the new clocks (from 5 February 2026). Article 12A of UK GDPR, inserted by section 76 of the 2025 Act, keeps one month as the period but fixes when it starts: at the latest of receiving the request, receiving any information asked for to confirm identity, or payment of any fee. It may be extended by two further months for complex or numerous requests, by a notice given within the first month that states the reasons. For a subject access request only, the clock stops from the day the controller asks for information it reasonably needs to identify what is sought until the day it arrives. The search itself is limited by Article 15(1A) to what the controller “is able to provide based on a reasonable and proportionate search”. The subject access request policy guide sets out the full procedure.
4. Safeguards for solely automated significant decisions (from 5 February 2026). Article 22A of UK GDPR treats a decision as solely automated if there is “no meaningful human involvement”, and significant if it has a legal or similarly significant effect. Where such a decision is made, Article 22C requires safeguards that tell the person about it and let them make representations, obtain human intervention and contest it. Few schools, nurseries, charities or care providers take such decisions, but a recruitment-screening or eligibility tool can.
5. Children's needs in online services (from 5 February 2026). The ICO's summary says “if you provide an online service that is likely to be used by children, the DUAA explicitly requires you to take their needs into account when you decide how to use their personal information.”

The ICO's How does the ICO deal with complaints? explains why the complaints process matters in practice: “In most cases, if someone complains to us about the way you’ve handled their personal information, we’ll ask them to raise a complaint with you first.” That is the regulator's practice, not a condition in the Act: section 165 of the Data Protection Act 2018, which replaced Article 77 of UK GDPR on 19 June 2026, lets a person complain to the Information Commission directly.

What you may now do: the new options

The rest of the Act's main changes give organisations choices they did not have before 5 February 2026.

• Recognised legitimate interests. Article 6(1)(ea) of UK GDPR adds a seventh lawful basis: processing “necessary for the purposes of a recognised legitimate interest”, which means one of the conditions in Annex 1: disclosure in response to a request from another body that needs the data for its own public task, national security, public security and defence, responding to an emergency, crime, and safeguarding a vulnerable individual. Annex 1 defines a vulnerable individual as someone aged under 18, or aged 18 or over and at risk. The ICO's summary of the data protection changes says “There is still a necessity test, but there is no requirement for an organisation to carry out an additional balancing test”. Two limits: it is not a general public interest basis, and Article 6(1) says “Points (ea) and (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.” Record the choice of basis either way.
• Further use of data for a new purpose. The compatibility test that sat in Article 6(4) was replaced on 5 February 2026 by Article 8A of UK GDPR and Annex 2, which set out when processing for a new purpose is compatible with the original one. Cite Article 8A, not Article 6(4), in a policy written now.
• Cookies without consent for listed purposes. Schedule A1 to PECR now lets a website set some storage and access technologies without consent: those strictly necessary for the service, and those used only “to collect information for statistical purposes about how the service is used with a view to making improvements to the service” or “to otherwise enable an enhancement of the appearance or functionality of the website”. Statistics collected this way may be shared only with someone helping to make the improvements, and the last two apply only if the user gets “clear and comprehensive information about the purpose of the storage or access” and “a simple means of objecting, free of charge, to the storage or access” and does not object. Cookies for any other purpose, such as advertising, still need consent. A separate exemption covers locating someone for emergency assistance.
• Email marketing by charities. Regulation 22(3A) of PECR lets a charity send marketing email without consent where “the sole purpose of the direct marketing is to further one or more of the charity’s charitable purposes”, the contact details were collected when the person expressed an interest in those purposes or offered or gave support, and they were given a simple, free way to refuse when the details were collected and in every message since. The ICO's How do we comply with the PECR electronic mail marketing rules? adds a limit: “You must only use it if you obtained the recipient’s contact details on or after this date”, meaning 5 February 2026. An existing supporter list does not qualify.

What it means in schools, early years, charities and care

The same law applies in every sector, but the changes land differently.

• Schools, academy trusts and maintained nurseries. Maintained schools and academy trusts are public authorities, so recognised legitimate interests is not available for their statutory work; an independent school can use it, but only for an Annex 1 purpose. The Department for Education's Data (Use and Access) Act 2025 (DUAA): compliance checklist for schools, for schools in England, says “Public authorities cannot rely on recognised legitimate interests to carry out their statutory functions. Public task will usually remain the most appropriate lawful basis where schools are carrying out their statutory functions.” Its checklist asks schools to review the subject access procedure (“Exhaustive searches are not required”), create or review a data protection complaints procedure, check automated decisions, review lawful bases, update privacy notices and review cookies. The DfE's older chapter Data processing a school is permitted to do, last updated in 2023, still says “there are 6 lawful bases”; since 5 February 2026 Article 6(1) has seven. See GDPR in schools and privacy notice for schools.
• Private, voluntary and independent nurseries and childminders. The complaints process and the new privacy notice item apply to every controller, a childminder working alone included. A provider that is not a public authority can rely on recognised legitimate interests for an Annex 1 purpose, most often safeguarding a child, without a balancing test. A nursery website with analytics cookies can use the new exemption only with the information and the simple objection the schedule requires. See GDPR for nurseries and childminders.
• Charities. The soft opt-in for charitable purposes is the change most charities will use, for contact details collected on or after 5 February 2026. Recognised legitimate interests covers safeguarding a child or an adult at risk. Whether an academy trust, which is an exempt charity and also a public authority, can rely on the charity soft opt-in is not settled: PECR is only half the test, because the email also needs a UK GDPR lawful basis, and a public authority cannot use legitimate interests in the performance of its tasks. Take advice before relying on it. See GDPR policy for a small charity.
• Care providers. Annex 1's safeguarding condition reaches an adult aged 18 or over who is at risk, which Annex 1 defines by reference to needs for care and support, neglect or harm, and being unable to protect themselves. In England, Schedule 15 to the 2025 Act lets information standards for health and adult social care cover the IT and IT services used to process information, and bind “a relevant IT provider”, so the standards can now reach the suppliers of a care provider's software as well as the provider. The data protection complaints process applies here too, beside the care home complaints procedure. See care home data protection.

The regulator, and what did not change

The regulator is now the Information Commission. Commencement No. 9 abolished the office of Information Commissioner and transferred its functions on 30 September 2026, and its regulation 3 treats anything done or in progress by or in relation to the Information Commissioner as done by or in relation to the Information Commission, so work under way carried on. The regulator still calls itself the ICO. The Act also gave it new powers; the ICO says “Among the new powers that DUAA provides us with is the ability to compel a witness to attend an interview and to request reports of approved persons.”

Some things did not change, despite what is sometimes said:

• The 72-hour breach report. Article 33 of UK GDPR still requires a notifiable personal data breach to be reported without undue delay and, where feasible, “not later than 72 hours after having become aware of it”. Section 111 of the Act set the same 72-hour limit in the separate breach rule in PECR for providers of public electronic communications services; it did not change Article 33. See school data breach.
• The data protection fee. The Act did not change the fee; see the data protection fee.
• UK GDPR itself. It remains the law, as amended, beside the Data Protection Act 2018 and PECR; the Act changed parts of each and replaced none.
• The malicious-allegation erasure ground in Article 17(1)(g) of UK GDPR, which arrived on 31 March 2026, is a Victims and Prisoners Act 2024 change; the 2025 Act only extended it beyond England and Wales. It applies where an allegation by a person convicted of a listed stalking or harassment offence against the data subject, or subject to a stalking protection order, has been investigated and the controller has decided to take no further action.

Where ComplyChat fits, and where it does not

ComplyChat is not a data protection compliance tool. It does not write privacy notices or complaints procedures, manage cookie banners or send charity marketing email, and nothing about it makes an organisation compliant with the Data (Use and Access) Act 2025.

What it touches is narrower. The complaints duty and the reasonable and proportionate search both assume the organisation can find what its people said about the person who is asking. A concern raised by text to a manager's own phone, or a decision made in a staff group chat at nine in the evening, may be within a subject access request or a complaint and yet sit where the organisation cannot search it; subject access requests and WhatsApp messages covers what that means for the search.

ComplyChat is designed to bring those conversations into channels the organisation runs. Staff, and parents, families or volunteers added by their mobile number, take part without an account on the organisation's systems, because a mobile number verified by SMS is the identity. Everyone added is told the channel is on the record and can object or leave. Messages are recorded on the server as they are sent, and on paid plans, once the organisation's tenant is connected, they are kept under the retention schedules within its own Microsoft 365 subscription, where a search for a request or a complaint can reach them. It replaces the group chat; it does not capture WhatsApp.

A question for the next leadership or board meeting: which of the documents in section 03 has been updated since February 2026, and if a complaint arrived tomorrow, could you find every message it would touch?

Questions people ask

When did the Data (Use and Access) Act 2025 come into force?

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and came into force in stages through commencement regulations: most data protection changes on 5 February 2026 (S.I. 2026/82), the complaints duty on 19 June 2026 (the same instrument), and the Information Commission on 30 September 2026 (S.I. 2026/1015). The reasonable and proportionate search for subject access requests came in on Royal Assent, treated as in force from 1 January 2024.

Does the Data (Use and Access) Act replace UK GDPR?

No. The ICO says the Act “amends, but does not replace” the UK GDPR, the Data Protection Act 2018 and PECR, so organisations keep working under those three laws as amended.

Is all of the Data (Use and Access) Act in force?

All of its data protection and privacy provisions are in force, as the ICO's hub page confirms. A few unrelated parts are not, as at 10 November 2026: sections 45 to 48 (public bodies sharing information with digital verification services), the National Underground Asset Register in Part 3, and section 131 and most of section 133 on electronic trust services. Part 4, on registers of births and deaths, came into force on 9 November 2026 under Commencement No. 10 (S.I. 2026/1167).

What is a recognised legitimate interest?

A recognised legitimate interest is a lawful basis added as Article 6(1)(ea) of UK GDPR on 5 February 2026, for processing necessary for a condition listed in Annex 1: answering another body's request for data it needs for its public task, national security, public security and defence, emergencies, crime, and safeguarding a vulnerable individual. A necessity test still applies but no balancing test, and public authorities cannot use it for processing in the performance of their tasks.

What do schools need to do about the Data (Use and Access) Act?

The DfE's checklist for schools in England asks them to review the subject access procedure, create or review a data protection complaints procedure, check any automated decisions, review lawful bases, update privacy notices to name the new right to complain to the school, and review cookies. Public task usually remains the lawful basis for a school's statutory functions.

Is the ICO still called the ICO?

Yes, in practice. The office of Information Commissioner was abolished and its functions transferred to the Information Commission on 30 September 2026 (S.I. 2026/1015), and the regulator's website still calls itself the ICO.

Official guidance and your next step

The Act is on legislation.gov.uk as the Data (Use and Access) Act 2025, with each commencement instrument linked in section 02 above. The government's plans for commencement page (updated 12 October 2026) explains the stages. The ICO's Data (Use and Access) Act 2025 hub and its guide to what the Act means for organisations are the regulator's view; its summary of the data protection changes was last updated in August 2025, before the 2026 commencements, so read its dates against the instruments. For schools in England, the DfE's compliance checklist for schools is the department's list. Quotations are from the pages named as read between 8 and 10 November 2026.

This guide covers the UK; the DfE's checklist applies to schools in England, and Schedule 15's information standards to health and adult social care in England. It is not legal advice.

Then do one thing: list the six documents the Act touches – the complaints procedure, the privacy notices, the subject access procedure, the record of lawful bases, the cookie notice and, for a charity, the email marketing consent wording – and write beside each the date it was last revised. Anything dated before 5 February 2026 is the place to start.