The Data (Use and Access) Act 2025 (Commencement No. 3 and Transitional and Saving Provisions) Regulations 2025

The Data (Use and Access) Act 2025 (Commencement No. 3 and Transitional and Saving Provisions) Regulations 2025

Skip to main content
Skip to navigation
legislation.gov.uk
https://www.nationalarchives.gov.uk
Cymraeg
Home
Explore our collections
Research tools
Help and guidance
What's new
About us
Search Legislation
The Data (Use and Access) Act 2025 (Commencement No. 3 and Transitional and Saving Provisions) Regulations 2025
You are here:
UK Statutory Instruments
2025 No. 996 (C. 48)
Whole
Instrument
Table of Contents
Content
More Resources
Previous
Next
Plain View
Print Options
What Version
Latest available (Revised)
Original (As made)
Opening Options
Open whole Instrument
More Resources
Original: King's Printer Version
View more
Status:
This is the original version (as it was originally made). This item of legislation is currently only available in its original format.
Statutory Instruments
2025 No. 996 (C. 48)
DATA PROTECTION
The Data (Use and Access) Act 2025 (Commencement No. 3 and Transitional and Saving Provisions) Regulations 2025
Made
4th September 2025
The Secretary of State makes these Regulations in exercise of the powers conferred by sections 142(1) and 143(1) of the Data (Use and Access) Act 2025(
1
).
Citation and interpretation
1.
—(1) These Regulations may be cited as the Data (Use and Access) Act 2025 (Commencement No. 3 and Transitional and Saving Provisions) Regulations 2025.
(2) In these Regulations—
“
the 2018 Act
” means the Data Protection Act 2018(
2
);
“
the 2025 Act
” means the Data (Use and Access) Act 2025;
“
the Commissioner
” has the same meaning as in section 3(8) of the 2018 Act;
“
controller
” has the same meaning as in section 3(6) of the 2018 Act;
“
data subject
” has the same meaning as in section 3(5) of the 2018 Act;
“
the relevant time
” means the time when sections 79 and 88 of the 2025 Act come into force.
Commencement
2.
—(1) The following provisions of the 2025 Act come into force on the day after the day on which these Regulations are made—
(a)
section 79 (legal professional privilege exemption);

(b)
section 88 (national security exemption).

(2) The following provisions of the 2025 Act, so far as not already in force, come into force on 17th November 2025—
(a)
section 89 (joint processing by intelligence services and competent authorities);

(b)
section 90 (joint processing: consequential amendments).

Transitional and saving provision relating to data subjects’ rights to information: legal professional privilege exemption
3.
  Section 79 of the 2025 Act does not affect the application of Chapter 3 (rights of the data subject) of Part 3 (law enforcement processing) of the 2018 Act in a case in which a controller received a request under a section of that Chapter before the relevant time.
Transitional and saving provisions relating to the national security exemption
4.
—(1) Section 88 of the 2025 Act does not affect the application of—
(a)
Chapter 3 of Part 3 of the 2018 Act, in a case in which a controller received a request under a section of that Chapter before the relevant time;

(b)
section 51 (exercise of rights through the Commissioner) of the 2018 Act, in a case in which the Commissioner received a request under that section before the relevant time;

(c)
sections 67 and 68 (obligations relating to personal data breaches) of the 2018 Act, in a case in which a personal data breach (within the meaning given by section 33(2) of the 2018 Act) occurred before the relevant time(
3
);

(d)
section 119 (inspection of personal data) of the 2018 Act, in a case in which a controller received written notice under that section before the relevant time;

(e)
Schedule 13 (other general functions of the Commissioner) to the 2018 Act, in a case in which the Commissioner(
4
)—

(i)
commenced enforcement action pursuant to paragraph 1(1)(a) of that Schedule, before the relevant time; or

(ii)
received information under paragraph 1(1)(g) of that Schedule, before the relevant time;

(f)
sections 142 to 154 (enforcement) of, and Schedule 15 (powers of entry and inspection) to, the 2018 Act, in relation to any of the following which is received by a controller before the relevant time(
5
)—

(i)
an information notice;

(ii)
an assessment notice;

(iii)
an enforcement notice;

(g)
section 173 (alteration of personal data to prevent disclosure) of the 2018 Act, in a case in which a controller received a request pursuant to that section before the relevant time(
6
);

(h)
section 187 (representation of data subjects) of the 2018 Act, in a case in which, before the relevant time, a body or other organisation authorised to act on behalf of a data subject in accordance with that section(
7
)—

(i)
made a complaint to the Commissioner under section 165 (complaints by data subjects)(
8
);

(ii)
made an application to the Tribunal under section 166 (orders to progress complaints)(
9
);

(iii)
made an application to the court under section 167 (compliance orders)(
10
); or

(iv)
brought judicial review proceedings.

(2) Section 88 of the 2025 Act does not affect the application of section 79(2) to (13) of the 2018 Act to a certificate issued under section 79(1) before the relevant time.
Hanson
Minister of State
Home Office
4th September 2025
Explanatory Note
(This note is not part of the Regulations)

These are the third commencement Regulations made under the Data (Use and Access) Act
2025 (c. 18)
(“
the 2025 Act
”).

Regulation 2 brings into force sections 79, 88, 89 and 90 of the 2025 Act, which amend the Data Protection Act
2018 (c. 12)
(“
the 2018 Act
”). Sections 79 (legal professional privilege exemption) and 88 (national security exemption) come into force on the day after the day on which these Regulations are made. Sections 89 (joint processing by intelligence services and competent authorities) and 90 (joint processing: consequential amendments) come into force on 17th November 2025.

Regulation 3 makes transitional and saving provision. The new legal professional privilege exemption does not apply where someone made a request to a data controller in accordance with the 2018 Act before section 79 of the 2025 Act came into force.

Regulation 4 makes transitional and saving provision. The national security exemptions in Part 3 of the 2018 Act - before they were changed by the 2025 Act - still apply in certain cases. These include situations where a person made a request to a data controller before section 88 of the 2025 Act came into force. It also covers cases where the controller had a duty or obligation before section 88 came into force.

An impact assessment has not been prepared for this instrument as a full impact assessment was published in relation to the provisions in the Data (Use and Access) Bill. Copies can be obtained from the UK Government website at
https://www.gov.uk/government/publications/data-use-and-access-bill-supporting-documents
or from the Department for Science, Innovation and Technology at 22-26 Whitehall, London, SW1A 2EG, United Kingdom.

NOTE AS TO EARLIER COMMENCEMENT Regulations
(This note is not part of the Regulations)

The following provisions of the Data (Use and Access) Act
2025 (c. 18)
have been brought into force, so far as they were not already in force (see section 142(2)(h) of that Act), by commencement Regulations made before the date of these Regulations.

Provision
Date of Commencement
S.I. No.
Part 1
20th August 2025
2025/904
section 72 (partially)
20th August 2025
2025/904
section 74
20th August 2025
2025/904
section 84
20th August 2025
2025/904
section 91 to 93
20th August 2025
2025/904
section 95
20th August 2025
2025/904
section 102
20th August 2025
2025/904
section 104
20th August 2025
2025/904
section 106 to 109
20th August 2025
2025/904
section 110 (partially)
20th August 2025
2025/904
section 111
20th August 2025
2025/904
section 113
20th August 2025
2025/904
section 117 (partially)
20th August 2025
2025/904
section 124
30th September 2025
2025/982
section 125
20th August 2025
2025/904
section 129
20th August 2025
2025/904
section 134 to 137
20th August 2025
2025/904
Schedule 11 (partially)
20th August 2025
2025/904
Schedule 14
20th August 2025
2025/904

(
1
)
2025 c. 18
.
(
2
)
2018 c. 12
.
(
3
)
Section 67 was amended by
S.I. 2019/419
.
(
4
)
Schedule 13 was amended by
S.I. 2019/419
.
(
5
)
Sections 142 and 143 were amended by the Data (Use and Access) Act 2025, section 97 and
S.I. 2019/419
. Sections 145 and 148 were amended by the Data (Use and Access) Act 2025, section 97.
(
6
)
Section 173 was amended by
S.I. 2019/419
.
(
7
)
Section 187 was amended by
S.I. 2019/419
.
(
8
)
Section 165 was amended by
S.I. 2019/419
.
(
9
)
Section 166 was amended by
S.I. 2019/419
.
(
10
)
Section 167 was amended by
S.I. 2019/419
.
Previous
Next
Back to top
Options/Help
Print Options
Official printed copies
Order a copy of this legislation
buy now
Print
The Whole
Instrument
PDF
The Whole
Instrument
Web page
The Whole
Instrument
Legislation is available in different versions:
Latest Available (revised):
The latest available updated version of the legislation incorporating changes made by subsequent legislation and applied by our editorial team. Changes we have not yet applied to the text, can be found in the ‘Changes to Legislation’ area.
Original (As Enacted or Made):
The original version of the legislation as it stood when it was enacted or made. No changes have been applied to the text.
Opening Options
Different options to open legislation in order to view more content on screen at once
More Resources
Access essential accompanying documents and information for this legislation item from this tab. Dependent on the legislation item being viewed this may include:
the original print PDF of the as enacted version that was used for the print copy
lists of changes made by and/or affecting this legislation item
confers power and blanket amendment details
all formats of all associated documents
correction slips
links to related legislation and further information resources
More Resources
Use this menu to access essential accompanying documents and information for this legislation item. Dependent on the legislation item being viewed this may include:
the original print PDF of the as made version that was used for the print copy
correction slips
Click 'View More' or select 'More Resources' tab for additional information including:
lists of changes made by and/or affecting this legislation item
confers power and blanket amendment details
all formats of all associated documents
links to related legislation and further information resources
The data on this page is available in the
alternative data formats
listed:
HTML5
alternative version
HTML snippet
alternative version
PDF
alternative version
XML
alternative version
Akoma Ntoso
alternative version
HTML RDFa
alternative version
RDF/XML
alternative version
New site design
Help
About us
Site map
Accessibility
Contact us
Privacy notice
Cookies
All content is available under the
Open Government Licence v3.0
except where
otherwise stated
. This site additionally contains content derived from EUR-Lex, reused under the terms of the
Commission Decision 2011/833/EU
on the reuse of documents from the EU institutions. For more information see the
EUR-Lex public statement on re-use
.
©
Crown and database right