Data (Use and Access) Act 2025: plans for commencement — GOV.UK

Data Use and Access Act 2025plans for commencement - GOV.UK

Cookies on GOV.UK

We use some essential cookies to make this website work.
We’d like to set additional cookies to understand how you use GOV.UK, remember your settings and improve government services.
We also use cookies set by other sites to help us deliver content from their services.

You have accepted additional cookies.
You can
change your cookie settings
at any time.

You have rejected additional cookies.
You can
change your cookie settings
at any time.

Accept additional cookies

Reject additional cookies

View cookies

Hide cookie message

Skip to main content

Guidance

Data Use and Access Act 2025plans for commencement

A summary of the government’s plans for bringing into force provisions in the Data (Use and Access) Act 2025.

From:

Department for Science, Innovation and Technology

Published

25 July 2025

Last updated

5 February 2026
—

See all updates

Print this page

Background

The Data (Use and Access) Act (“the Act”) received Royal Assent on 19 June 2025. Some of the provisions in the Act will come into force automatically by virtue of section 142 of the Act. This includes any regulation-making powers in the Act, including those in Part 1 allowing for the future development of smart data schemes.

Many of the Act’s provisions will need to be commenced via regulations. The government plans to commence these provisions in
4 main stages
, set out below. This is not a complete list of measures in the Act but is intended to illustrate the government’s staged approach to commencement.

Stage 1

Stage 1 will include the commencement of technical provisions which clarify aspects of the legal framework; and measures requiring the government to publish an impact assessment, a report and a progress update on Artificial Intelligence (
AI
) and copyright issues.

Stage 2

Stage 2, 3 to 4 months after Royal Assent, will include the commencement of most of the measures on digital verification services in Part 2 of the Act; and measures in Part 7 on the retention of information by providers of internet services in connection with the death of a child.

Stage 3

Stage 3, approximately 6 months after Royal Assent, will include the commencement of the main changes to data protection legislation in Part 5 of the Act except for section 103 on complaints by data subjects. This stage will also include the provisions on information standards for health and adult social care in England in Part 7.

Stage 4

Stage 4, more than 6 months after Royal Assent, will include the commencement of provisions that require a longer lead-in time. Examples include measures on the National Underground Register in Part 3 of the Act, and the electronic system of registering births and deaths in Part 4, which rely on appropriate technology being in place. Measures in Part 5 requiring controllers to establish processes for handling complaints from data subjects are expected to be commenced approximately 12 months after Royal Assent. Changes to the Information Commissioner’s Office (
ICO
) governance structures in Part 6 of the Act will take place once members of the Information Commission’s new Board have been appointed. This is expected in early 2026.

Summary of Stage 1 regulations

These regulations bring into force specified provisions of the Data (Use and Access) Act 2025 on 20 August 2025. They are the first commencement regulations made under the Act. They include:

technical provisions

new statutory objectives for the Information Commissioner’s Office when carrying out its functions

provisions requiring the government to prepare a progress update and a report on copyright works and artificial intelligence systems.

Stage 1 regulations

Regulation

Date

The Data (Use and Access) Act 2025 (Commencement No.1) Regulations 2025

21 July 2025

Summary of Stage 2 regulations

These regulations commence section 124 of the Data (Use and Access) Act 2025 on 30 September 2025. Section 124 amends the Online Safety Act 2023. It includes a duty on Ofcom to issue notices requiring the retention of information by social media providers and other regulated services when required by the coroner or procurator fiscal in connection with an investigation into the death of a child.

The Data (Use and Access) Act 2025 (Commencement No. 3 and Transitional and Saving Provisions) Regulations bring into force sections 79, 88, 89 and 90 of the
DUAA
. These amend Parts 3 and 4 of the Data Protection Act 2018 (DPA) which govern the processing of personal data for law enforcement purposes and by the intelligence services.

Stage 2 regulations

Regulation

Date

The Data (Use and Access) Act 2025 (Commencement No.2) Regulations 2025

2 September

The Data (Use and Access) Act 2025 (Commencement No. 3 and Transitional and Saving Provisions) Regulations 2025

4 September

(Published on legislation.gov.uk).

Summary of Stage 3 regulations

The Data (Use and Access) Act 2025 (Commencement No. 4) Regulations 2025 bring into force the majority of the measures in Part 2 of the Data (Use and Access) Act 2025 on 1 December 2025. This brings the UK digital identity and attributes trust framework, statutory register, and related measures onto statutory footing. These measures will be maintained by the Office for Digital Identities and Attributes: 
https://www.gov.uk/ofdia

The Data (Use and Access) Act 2025 (Commencement No. 5) Regulations 2026 brings Section 138 of the Data (Use and Access) Act 2025 into force on 6 February 2026, providing for new offences relating to creating or requesting the creation of  purported intimate images of an adult without consent or reasonable belief in consent.

The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 bring into force the majority of the data protection and privacy provisions in Part 5 of
DUAA
 on 5 February 2026. They include changes which simplify aspects of the UK GDPR and modernise the Information Commissioner’s enforcement powers.

Further information on these provisions can be found atData (Use and Access) Act 2025: factsheets
 page. The
ICO
is publishing and updating relevant guidance to reflect these changes
.

Stage 3 regulations

Regulation

Date

The Data (Use and Access) Act 2025 (Commencement No. 4) Regulations 2025

1 December 2025

The Data (Use and Access) Act 2025 (Commencement No. 5) Regulations 2026

6 February 2026

The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026

5 February 2026

(Published on legislation.gov.uk).

Updates to this page

Published 25 July 2025

Last updated 5 February 2026

+
show all updates

5 February 2026

Summary of Stage 3 regulations published.

11 September 2025

Summary of Stage 2 regulations published.

25 July 2025

First published.

Sign up for emails or print this page

Print this page

Contents

Related content

Is this page useful?

Maybe

Yes
this page is useful

No
this page is not useful

Thank you for your feedback

Report a problem with this page

Help us improve GOV.UK

To help us improve GOV.UK, we’d like to know more about your visit today.

Please fill in this survey (opens in a new tab
)
.

Cancel