Data Use and Access Act 2025: Compliance, Cookies, and Commencement

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and is the most significant change to UK data protection law since Brexit. Rather than replacing the UK GDPR or the Data Protection Act 2018, it amends them: loosening some compliance burdens on businesses and researchers, tightening protections for children, and adding new regimes for digital identity verification, cross-sector data sharing, and mapping of underground infrastructure. It also restructures the regulator itself. The changes are rolling out in waves through mid-2026, so what you need to do depends partly on which provisions have commenced.

Who Has to Comply

Because the Act works by amending the UK GDPR, its reach follows that framework. If your organisation processes personal data in connection with activities carried out by an establishment in the UK, you are in scope, regardless of where the processing happens. An establishment can be as minimal as a single employee or agent operating from a UK office, provided the arrangement is stable and the activities real.¹

Organisations based entirely outside the UK are still caught if they target people in the UK, either by offering goods or services to UK residents or by monitoring their behaviour. Signs of targeting include running a UK marketing campaign, listing prices in pounds sterling, using a .co.uk domain, paying search engines to direct UK traffic, or tracking online activity for behavioural advertising. Organisations caught this way generally need to appoint a UK-based representative, unless the processing is occasional and low-risk.¹

What Changes for Everyday Data Processing

The Act does not rewrite the lawful bases or core principles, but it makes a series of targeted changes that shift compliance in areas where the old rules had been causing friction.

Recognised Legitimate Interests

The Act creates a new category of “recognised legitimate interests” that no longer require the traditional balancing test between the organisation’s interests and the individual’s rights. The initial list focuses on areas such as safeguarding national security and detecting crime rather than everyday commercial processing. The government can expand the list through secondary legislation.²

Separately, the Act confirms that direct marketing, intra-group data transfers, and network security can be pursued as ordinary legitimate interests. The balancing test still applies to these, but the legal footing is firmer than before.

Automated Decision-Making

Previously, decisions made solely by automated systems with legal or similarly significant effects could only rest on a narrow set of lawful bases. The Act opens this up: organisations can now rely on the full range of lawful bases, including legitimate interests, provided appropriate safeguards are in place. Special category data such as health, ethnicity, or political opinions remains more restricted and cannot be processed this way under the expanded rules.³

Subject Access Requests

Subject access requests get three practical adjustments. If you need the requester to clarify or narrow a vague request, the statutory response clock now stops until you receive that clarification. The Act makes explicit that only reasonable searches are required. And it introduces a new exemption for material covered by legal professional privilege.²

International Data Transfers

The old “adequacy” test is replaced with a new standard: whether the destination provides a level of data protection “not materially lower” than the UK’s. The same test applies when using alternative transfer mechanisms like standard contractual clauses. Controllers and processors are expected to act reasonably and proportionately in reaching that judgment.²

Children’s Data

Services aimed at children face tighter, not looser, expectations. When designing processing activities, providers must now account for “children’s higher protection matters”, including how to protect children who use the service, the fact that children may not fully understand data risks, and the reality that children of different ages have different needs.²

Cookies and Analytics

The Act amends the Privacy and Electronic Communications Regulations 2003. The general rule against storing or accessing information on a user’s device without consent stays, but the list of exceptions grows. The most useful new exception is for analytics cookies, meaning cookies that collect statistical information about how an online service is used, where the aim is to improve that service. Under the old rules, even basic website analytics required consent. That requirement disappears for qualifying analytics use. The existing exceptions, such as strictly necessary cookies, are unchanged.⁴

The Secretary of State can add further cookie exceptions through secondary regulations after consulting the ICO. So the current changes are relatively narrow, but the mechanism is in place for more.

Scientific Research

The rules for using personal data in scientific research, including commercial research, are clarified to make reuse easier. Individuals can now give “broad consent” to an area of research instead of consenting to each study separately. Where reusing data for research would ordinarily require issuing a fresh privacy notice and doing so would take disproportionate effort, the Act allows the organisation to skip individual notification, provided it protects the individuals’ rights in other ways and publishes the notice on its website.³

Digital Verification Services

Part 2 of the Act establishes a statutory framework for digital identity services. The UK digital identity and attributes trust framework sets up a certification scheme, run through conformity assessment bodies, that evaluates whether an identity verification provider’s products and processes meet defined standards. The framework is deliberately technology-agnostic, defining the outcomes providers must achieve rather than mandating specific encryption protocols.⁵

Certified providers appear on an official register, and providers who fall below the required standards can be removed. The Act provides the legal basis for that register and the surrounding oversight, with detail expected to develop through secondary legislation and guidance.

Smart Data Schemes

The Act gives government the power to require businesses in designated sectors to share customer records with authorised third parties when the customer requests it. The concept follows Open Banking and is expected to reach into energy, telecommunications, and other regulated industries. In-scope businesses will need interoperable technical interfaces so the shared data is actually usable by other providers. Once a valid request comes through an approved channel, sharing is not discretionary, and the data must be accurate and current. Penalties for systemic failures can be substantial, with specific enforcement mechanisms shaped by the regulations issued for each sector.

National Underground Asset Register

The Act requires the Secretary of State to maintain a National Underground Asset Register (NUAR): a register of underground pipes, cables, and similar apparatus in streets across England and Wales, with scope to include Northern Ireland. Utility companies and other undertakers must upload their existing records into NUAR within a prescribed initial period. Failing to do so is a criminal offence punishable by a fine on summary conviction, and the undertaker is also liable to compensate anyone who suffers loss because of the failure. The defence is that all reasonable care was taken to comply.⁶

Modernising Birth and Death Registration

Part 4 amends the Births and Deaths Registration Act 1953 to move the system off paper. Registers must now be kept in whatever form the Registrar General requires, including electronic formats. When a register is electronic, entries made by a local registrar are immediately available to the superintendent registrar and the Registrar General, so the old system of quarterly paper returns is abolished. Where a register is no longer kept in hard copy, the physical signature requirement can be replaced with alternative authentication methods set by regulations.⁷

A New Information Commission

Part 6 abolishes the office of the Information Commissioner and transfers its functions to a new body called the Information Commission.⁸ The regulator moves from a single-person model to a board-led body corporate, in line with other major UK regulators.

The Act also gives the regulator new statutory duties. It must have regard to the desirability of promoting innovation and competition, the importance of preventing and detecting crime, the need to safeguard public and national security, and the fact that children merit specific protection. It must consult other regulators on matters connected to economic growth, innovation, and competition.⁹ The enforcement toolkit, including substantial fines and enforcement notices, is largely intact, but organisations facing regulatory action have new grounds to argue proportionality and economic impact.

Transfers to the United States

For US-based recipients of UK personal data, the main transfer mechanism is the UK Extension to the EU-US Data Privacy Framework, known as the UK-US Data Bridge. A US organisation must first participate in the EU-US Data Privacy Framework and then separately opt into the UK Extension, self-certifying with the International Trade Administration through the Data Privacy Framework programme.¹⁰

Self-certification is voluntary, but once made it is enforceable under US law. The organisation must publicly commit to the DPF Principles, reflect that commitment in its privacy policies, and re-certify annually with the ITA. Falling off the Data Privacy Framework List removes the legal basis for receiving UK personal data under this route.¹⁰ The Act’s new “not materially lower” standard applies here too, so UK organisations transferring to US recipients should still assess the protections, particularly for sensitive data.

When Each Part Takes Effect

The Act commences in tranches. The first provisions took effect on 19 and 20 August 2025, shortly after Royal Assent. A second wave came into force on 5 February 2026. The remaining provisions are expected roughly twelve months after Royal Assent, meaning mid-2026 for the final batch.¹¹

Do not treat the final commencement date as your deadline. Many of the provisions that require real operational work, particularly the smart data obligations and the NUAR upload requirements, depend on secondary regulations that can be issued before final commencement. The ICO has said it will publish updated guidance as each wave arrives, so watch both the legislation and the regulator’s output through the rest of 2026.

1
Information Commissioner’s Office. Territorial Scope Fundamentals
2
GOV.UK. Data Use and Access Act Factsheet – UK GDPR and DPA
3
Information Commissioner’s Office. The Data Use and Access Act 2025 – What Does It Mean for Organisations
4
GOV.UK. Data Use and Access Act Factsheet – PEC Regulations
5
GOV.UK. Certification Scheme for the UK Digital Identity and Attributes Trust Framework
6
Legislation.gov.uk. Data (Use and Access) Act 2025 – Section 56
7
Legislation.gov.uk. Data (Use and Access) Act 2025 – Part 4 Registers of Births and Deaths
8
Legislation.gov.uk. Data (Use and Access) Act 2025
9
GOV.UK. Data Use and Access Act Factsheet – ICO
10
Data Privacy Framework. Data Privacy Framework (DPF) Program Overview
11
Information Commissioner’s Office. Data (Use and Access) Act 2025