Data Use and Access Act 2025: plans for commencement
A summary of the government’s plans for bringing into force provisions in the Data (Use and Access) Act 2025.
Background
The Data (Use and Access) Act (“the Act”) received Royal Assent on 19 June 2025. Some of the provisions in the Act will come into force automatically by virtue of section 142 of the Act. This includes any regulation-making powers in the Act, including those in Part 1 allowing for the future development of smart data schemes.
Many of the Act’s provisions will need to be commenced via regulations. The government plans to commence these provisions in 4 main stages, set out below. This is not a complete list of measures in the Act but is intended to illustrate the government’s staged approach to commencement.
Stage 1
Stage 1 will include the commencement of technical provisions which clarify aspects of the legal framework; and measures requiring the government to publish an impact assessment, a report and a progress update on Artificial Intelligence (AI) and copyright issues.
Stage 2
Stage 2, 3 to 4 months after Royal Assent, will include the commencement of most of the measures on digital verification services in Part 2 of the Act; and measures in Part 7 on the retention of information by providers of internet services in connection with the death of a child.
Stage 3
Stage 3, approximately 6 months after Royal Assent, will include the commencement of the main changes to data protection legislation in Part 5 of the Act except for section 103 on complaints by data subjects. This stage will also include the provisions on information standards for health and adult social care in England in Part 7.
Stage 4
Stage 4, more than 6 months after Royal Assent, will include the commencement of provisions that require a longer lead-in time. Examples include measures on the National Underground Register in Part 3 of the Act, and the electronic system of registering births and deaths in Part 4, which rely on appropriate technology being in place. Measures in Part 5 requiring controllers to establish processes for handling complaints from data subjects are expected to be commenced approximately 12 months after Royal Assent. Changes to the Information Commissioner’s Office (ICO) governance structures in Part 6 of the Act will take place once members of the Information Commission’s new Board have been appointed. This is expected in early 2026.
Summary of Stage 1 regulations
These regulations bring into force specified provisions of the Data (Use and Access) Act 2025 on 20 August 2025. They are the first commencement regulations made under the Act. They include:
- technical provisions
- new statutory objectives for the Information Commissioner’s Office when carrying out its functions
- provisions requiring the government to prepare a progress update and a report on copyright works and artificial intelligence systems.
Stage 1 regulations
| Regulation | Date |
|---|---|
| The Data (Use and Access) Act 2025 (Commencement No.1) Regulations 2025 | 21 July 2025 |
Summary of Stage 2 regulations
These regulations commence section 124 of the Data (Use and Access) Act 2025 on 30 September 2025. Section 124 amends the Online Safety Act 2023. It includes a duty on Ofcom to issue notices requiring the retention of information by social media providers and other regulated services when required by the coroner or procurator fiscal in connection with an investigation into the death of a child.
The Data (Use and Access) Act 2025 (Commencement No. 3 and Transitional and Saving Provisions) Regulations bring into force sections 79, 88, 89 and 90 of the DUAA. These amend Parts 3 and 4 of the Data Protection Act 2018 (DPA) which govern the processing of personal data for law enforcement purposes and by the intelligence services.
Stage 2 regulations
(Published on legislation.gov.uk).
Summary of Stage 3 regulations
The Data (Use and Access) Act 2025 (Commencement No. 4) Regulations 2025 bring into force the majority of the measures in Part 2 of the Data (Use and Access) Act 2025 on 1 December 2025. This brings the UK digital identity and attributes trust framework, statutory register, and related measures onto statutory footing. These measures will be maintained by the Office for Digital Identities and Attributes: https://www.gov.uk/ofdia
The Data (Use and Access) Act 2025 (Commencement No. 5) Regulations 2026 brings Section 138 of the Data (Use and Access) Act 2025 into force on 6 February 2026, providing for new offences relating to creating or requesting the creation of purported intimate images of an adult without consent or reasonable belief in consent.
The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 bring into force the majority of the data protection and privacy provisions in Part 5 of DUAA on 5 February 2026. They include changes which simplify aspects of the UK GDPR and modernise the Information Commissioner’s enforcement powers.
Further information on these provisions can be found at: Data (Use and Access) Act 2025: factsheets page. The ICO is publishing and updating relevant guidance to reflect these changes.
Stage 3 regulations
| Regulation | Date |
|---|---|
| The Data (Use and Access) Act 2025 (Commencement No. 4) Regulations 2025 | 1 December 2025 |
| The Data (Use and Access) Act 2025 (Commencement No. 5) Regulations 2026 | 6 February 2026 |
| The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 | 5 February 2026 |
Summary of Stage 4 regulations
The Digital Economy Act 2017 (Commencement No. 2) (Northern Ireland) and Data (Use and Access) Act 2025 (Commencement No. 7) Regulations 2026 bring into force specific information-sharing and public service data provisions. This includes provisions which extend information-sharing powers under the Digital Economy Act 2017 so that public authorities can share information to support businesses and charities.
The Victims and Prisoners Act 2024 (Commencement No. 10) and Data (Use and Access) Act 2025 (Commencement No. 8) Regulations 2026 bring into force section 31 of the 2024 Act and paragraph 32 of schedule 11 to the 2025 Act on 31 March 2026. These provisions amend the right of erasure in Article 17 of the UK GDPR by adding a new ground, Article 17(1)(g), which gives data subjects a right to request erasure of their personal data when that data has been processed as a result of an unfounded allegation made about the data subject by a malicious person. A ‘malicious person’ is defined as someone who has been convicted of an offence of stalking or harassment against the data subject (the victim of that offence); or is subject to a stalking protection order made to protect the data subject from a risk associated with stalking.
The Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026 commence the DUAA reforms to the UK’s data protection regulator by abolishing the office of the Information Commissioner, transferring its functions to the new Information Commission from 30 September 2026, and establishing transitional and accounting arrangements in connection with that transfer.
Stage 4 regulations
(Published on legislation.gov.uk).