Data Use and Access Act 2025: plans for commencement

Background

The Data (Use and Access) Act (“the Act”) received Royal Assent on 19 June 2025. Some of the provisions in the Act will come into force automatically by virtue of section 142 of the Act. This includes any regulation-making powers in the Act, including those in Part 1 allowing for the future development of smart data schemes.

Many of the Act’s provisions will need to be commenced via regulations. The government plans to commence these provisions in 4 main stages, set out below. This is not a complete list of measures in the Act but is intended to illustrate the government’s staged approach to commencement.

Stage 1

Stage 1 will include the commencement of technical provisions which clarify aspects of the legal framework; and measures requiring the government to publish an impact assessment, a report and a progress update on Artificial Intelligence (AI) and copyright issues.

Stage 2

Stage 2, 3 to 4 months after Royal Assent, will include the commencement of most of the measures on digital verification services in Part 2 of the Act; and measures in Part 7 on the retention of information by providers of internet services in connection with the death of a child.

Stage 3

Stage 3, approximately 6 months after Royal Assent, will include the commencement of the main changes to data protection legislation in Part 5 of the Act except for section 103 on complaints by data subjects. This stage will also include the provisions on information standards for health and adult social care in England in Part 7.

Stage 4

Stage 4, more than 6 months after Royal Assent, will include the commencement of provisions that require a longer lead-in time. Examples include measures on the National Underground Register in Part 3 of the Act, and the electronic system of registering births and deaths in Part 4, which rely on appropriate technology being in place. Measures in Part 5 requiring controllers to establish processes for handling complaints from data subjects are expected to be commenced approximately 12 months after Royal Assent. Changes to the Information Commissioner’s Office (ICO) governance structures in Part 6 of the Act will take place once members of the Information Commission’s new Board have been appointed. This is expected in early 2026.

Summary of Stage 1 regulations 

These regulations bring into force specified provisions of the Data (Use and Access) Act 2025 on 20 August 2025. They are the first commencement regulations made under the Act. They include:

• technical provisions
• new statutory objectives for the Information Commissioner’s Office when carrying out its functions
• provisions requiring the government to prepare a progress update and a report on copyright works and artificial intelligence systems.

Stage 1 regulations

Summary of Stage 2 regulations 

These regulations commence section 124 of the Data (Use and Access) Act 2025 on 30 September 2025. Section 124 amends the Online Safety Act 2023. It includes a duty on Ofcom to issue notices requiring the retention of information by social media providers and other regulated services when required by the coroner or procurator fiscal in connection with an investigation into the death of a child.

The Data (Use and Access) Act 2025 (Commencement No. 3 and Transitional and Saving Provisions) Regulations bring into force sections 79, 88, 89 and 90 of the DUAA. These amend Parts 3 and 4 of the Data Protection Act 2018 (DPA) which govern the processing of personal data for law enforcement purposes and by the intelligence services.

Stage 2 regulations

(Published on legislation.gov.uk).

Summary of Stage 3 regulations 

The Data (Use and Access) Act 2025 (Commencement No. 4) Regulations 2025 bring into force the majority of the measures in Part 2 of the Data (Use and Access) Act 2025 on 1 December 2025. This brings the UK digital identity and attributes trust framework, statutory register, and related measures onto statutory footing. These measures will be maintained by the Office for Digital Identities and Attributes: https://www.gov.uk/ofdia 

The Data (Use and Access) Act 2025 (Commencement No. 5) Regulations 2026 brings Section 138 of the Data (Use and Access) Act 2025 into force on 6 February 2026, providing for new offences relating to creating or requesting the creation of  purported intimate images of an adult without consent or reasonable belief in consent. 

The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 bring into force the majority of the data protection and privacy provisions in Part 5 of DUAA on 5 February 2026. They include changes which simplify aspects of the UK GDPR and modernise the Information Commissioner’s enforcement powers.

Further information on these provisions can be found at: Data (Use and Access) Act 2025: factsheets page. The ICO is publishing and updating relevant guidance to reflect these changes.

Stage 3 regulations

(Published on legislation.gov.uk).