The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026

Statutory Instruments

2026 No. 82 (C. 10)

Data

DATA PROTECTION

ELECTRONIC COMMUNICATIONS

The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026

Made

29th January 2026

The Secretary of State makes these Regulations in exercise of the powers conferred by sections 142(1) and 143(1) of the Data (Use and Access) Act 2025(1) and section 104(1)(a) of the Deregulation Act 2015(2).

Citation and interpretation

1.—(1) These Regulations may be cited as the Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026.

(2) In these Regulations—

“the 2018 Act” means the Data Protection Act 2018(3);

“the 2025 Act” means the Data (Use and Access) Act 2025;

“the Commissioner” has the same meaning as in section 3(8) of the 2018 Act;

“controller” has the same meaning as in section 3(6) of the 2018 Act(4);

“data subject” has the same meaning as in section 3(5) of the 2018 Act.

Provisions of the 2025 Act coming into force on 5th February 2026

2.  The following provisions of the 2025 Act, so far as not already in force(5), come into force on 5th February 2026—

(a) section 67 (meaning of research and statistical purposes);

(b) section 68 (consent to processing for the purposes of scientific research);

(c) section 70 (lawfulness of processing);

(d) section 71 (the purpose limitation);

(e) section 72 (processing in reliance on relevant international law);

(f) section 73 (elected representatives responding to requests);

(g) section 75 (fees and reasons for responses to data subjects’ requests about law enforcement processing);

(h) section 76 (time limits for responding to data subjects’ requests);

(i) section 77 (information to be provided to data subjects);

(j) section 80 (automated decision-making);

(k) section 81 (data protection by design: children’s higher protection matters);

(l) section 83 (general processing and codes of conduct);

(m) section 85 (transfers of personal data to third countries and international organisations);

(n) section 86 (safeguards for processing for research etc purposes);

(o) section 87 (section 86: consequential provision);

(p) section 94 (manifestly unfounded or excessive requests to the Commissioner);

(q) section 98 (power of the Commissioner to require a report);

(r) section 99 (assessment notices: removal of OFSTED restriction);

(s) section 100 (interview notices);

(t) section 101 (penalty notices);

(u) section 105 (consequential amendments to the EITSET Regulations);

(v) section 110 (interpretation of the PEC Regulations);

(w) section 112 (storing information in the terminal equipment of a subscriber or user);

(x) section 114 (use of electronic mail for direct marketing by charities);

(y) section 115 (Commissioner’s enforcement powers);

(z) section 116 (codes of conduct);

(z1) section 120 (transfer of property etc to the Information Commission);

(z2) section 121 (information standards for health and adult social care in England);

(z3) section 130 (recognition of EU conformity assessment bodies);

(z4) section 132 (recognition of overseas trust products);

(z5) subsection (4) of section 133 (co-operation between supervisory authority and overseas authorities);

(z6) Schedule 4 (lawfulness of processing: recognised legitimate interests);

(z7) Schedule 5 (purpose limitation: processing to be treated as compatible with original purpose);

(z8) Schedule 6 (automated decision-making: minor and consequential amendments);

(z9) Schedule 7 (transfers of personal data to third countries etc: general processing);

(z10) Schedule 8 (transfers of personal data to third countries etc: law enforcement processing);

(z11) Schedule 9 (transfers of personal data to third countries etc: minor and consequential amendments and transitional provision);

(z12) Schedule 11 (further minor provision about data protection), except paragraph 32;

(z13) Schedule 12 (storing information in the terminal equipment of a subscriber or user);

(z14) Schedule 13 (privacy and electronic communications: Commissioner’s enforcement powers);

(z15) Schedule 15 (information standards for health and adult social care in England).

Provisions of the 2025 Act coming into force on 19th June 2026

3.  The following provisions of the 2025 Act, so far as not already in force(6), come into force on 19th June 2026—

(a) section 103 (complaints by data subjects);

(b) Schedule 10 (complaints: minor and consequential amendments).

Savings provisions relating to section 76 (time limits for responding to data subjects’ requests)

4.  The amendments made by section 76 of the 2025 Act do not apply in relation to—

(a) a case in which the controller received a request from a data subject under Chapter III of the UK GDPR (rights of the data subject)(7) before 5th February 2026;

(b) a case in which the controller received a request from a data subject under Chapter 3 of Part 3 of the 2018 Act (rights of the data subject) before 5th February 2026;

(c) a case in which the controller received a request from a data subject under Chapter 3 of Part 4 of the 2018 Act (rights of the data subject) before 5th February 2026.

Saving provision relating to section 80 and Schedule 6 (automated decision-making)

5.  The amendments made by section 80 of, and Schedule 6 to, the 2025 Act do not apply in relation to any decision taken before 5th February 2026 to which Article 22(3) of the UK GDPR (automated individual decision-making, including profiling) or section 14(8) or 50(2) of the 2018 Act (automated decision-making authorised by law: safeguards) applied.

Saving provision relating to section 101 (penalty notices)

6.  The amendments made by section 101 of the 2025 Act do not apply in relation to a case where a notice of intent, within the meaning of paragraph 2(1) of Schedule 16 (penalties) to the 2018 Act, was given by the Commissioner to a person before 5th February 2026.

Transitional provision relating to section 103 and Schedule 10 (complaints by data subjects)

7.  The duties in section 164A(3) and (4) of the 2018 Act (handling of complaints by data subjects to controllers) inserted by section 103 of the 2025 Act apply only in relation to a complaint that is received by the controller on or after the 19th June 2026.

Transitional provision relating to section 115 and Schedule 13 (Commissioner’s enforcement powers): investigatory powers

8.—(1) On or after 5th February 2026, the Commissioner may exercise any investigatory powers applied to the PEC Regulations by regulation 31(9) (as substituted by section 115(5) of the 2025 Act), regardless of when the conduct to which the exercise of that power relates occurred.

(2) Paragraph (1) does not authorise the imposition of any enforcement sanction in respect of an act or omission occurring before 5th February 2026 (see the availability of enforcement sanctions in regulation 11).

Saving provision for exercise of powers begun under the PEC Regulations before 5th February 2026

9.  Where, before 5th February 2026, the Commissioner has exercised a power conferred by the PEC Regulations as they had effect immediately before that date, and that exercise has not been cancelled or withdrawn, those Regulations continue to have effect for the purpose of completing that exercise.

Saving provision for audits begun under regulations 5 and 5B of the PEC Regulations before 5th February 2026

10.  Paragraph 6 of regulation 5 of the PEC Regulations(10) and regulation 5B of those Regulations(11) continue to have effect for the purpose of completing any audit begun (and not cancelled) before 5th February 2026.

Transitional and savings provisions for enforcement action

11.—(1) Where any act or omission constituting a breach of the PEC Regulations occurred before 5th February 2026, any enforcement action taken in respect of that act or omission must be taken under those Regulations as they had effect immediately before that date.

(2) Where any act or omission constituting a breach of the PEC Regulations occurred on or after 5th February 2026, any enforcement action taken in respect of that act or omission must be taken under those Regulations as amended by section 115 of, and Schedule 13 to, the 2025 Act.

(3) The PEC Regulations as they had effect immediately before 5th February 2026 continue to have effect for the purposes of—

(a) imposing monetary penalties or other sanctions in respect of acts or omissions occurring before that date; and

(b) bringing or determining appeals in relation to such penalties or sanctions.

Amendment of the 2018 Act

12.—(1) The 2018 Act is amended as follows.

(2) In section 183A (protection of prohibitions and restrictions etc on processing: relevant enactments), in subsection (4), in the definition of “relevant enactment”, for “the day on which section 106(2) the Data (Use and Access) Act 2025 comes into force” substitute “20th August 2025”.

(3) In section 183B (protection of prohibitions and restrictions etc on processing: other enactments), in subsection (5)(b), for “the day on which section 106(2) of the Data (Use and Access) Act 2025 comes into force” substitute “20th August 2025”.

(4) In section 186A (protection of data subject’s rights: further provision), in subsection (5), for “the day on which section 106(4) of the Data (Use and Access) Act 2025 comes into force” substitute “20th August 2025”.

Ian Murray

Minister of State

Department for Science, Innovation and Technology

29th January 2026

Explanatory Note

(This note is not part of the Regulations)

These are the sixth commencement regulations made under the Data (Use and Access) Act 2025 (c. 18) (“the 2025 Act”).

Regulation 2 brings into force specified provisions of the 2025 Act on 5th February 2026.

Regulation 3 brings into force section 103 of, and Schedule 10 to, the 2025 Act on 19th June 2026.

Regulation 4 makes savings provisions in respect of time limits for responses to data subjects’ requests under the UK GDPR and the Data Protection Act 2018 (c. 12) (“the 2018 Act”). Where a controller received a request before section 76 of the 2025 Act comes into force, the time limits previously in force continue to apply.

Regulation 5 provides that the changes to the UK GDPR and the 2018 Act made by section 80 of the 2025 Act apply only to decisions taken on or after section 80 comes into force.

Regulation 6 provides that the changes made to the penalty notice provisions in the 2018 Act made by section 101 of the 2025 Act do not apply where the Information Commissioner has already issued a notice of intent before that section comes into force. In such cases, the previous penalty provisions continue to apply.

Regulation 7 makes transitional provisions for complaints by data subjects to controllers. The new duties on controllers to handle complaints from data subjects at section 164(A)(3) and (4) of the 2018 Act as inserted by section 103 of the 2025 Act apply only to complaints submitted to the controller on or after section 103 comes into force. Complaints made before that date continue to be handled under the previous arrangements.

Regulations 8 to 11 make transitional and saving provision in connection with the coming into force of section 115 of the 2025 Act, which amends the enforcement regime under the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426) (“the PEC Regulations”).

Regulation 8 provides that the Information Commissioner can exercise investigatory powers applied to the PEC Regulations by regulation 31 (as substituted by section 115(5) of the 2025 Act) in relation to conduct that took place before 5th February 2026 but clarifies that enforcement sanctions are determined by regulation 11.

Regulations 9 and 10 preserve the effect of the PEC Regulations for the purpose of completing the exercise of investigatory powers and audits begun before commencement.

The provisions governing the completion of such audits continue to apply where an audit was begun (and not cancelled) before that date.

Regulation 11 determines the applicable enforcement regime by requiring enforcement action (including the imposition of sanctions) to be taken under the PEC Regulations as they had effect immediately before commencement where the relevant conduct occurred before that date, and under the PEC Regulations as amended where the conduct occurred on or after commencement.

Regulation 12 makes amendments to the 2018 Act to update specified commencement references.

An impact assessment has not been prepared for this instrument as a full impact assessment was published in relation to the provisions in the Data (Use and Access) Bill. Copies can be obtained from the UK Government website at https://www.gov.uk/government/publications/data-use-and-access-bill-supporting-documents or from the Department for Science, Innovation and Technology at 22-26 Whitehall, London, SW1A 2EG, United Kingdom.

NOTE AS TO EARLIER COMMENCEMENT Regulations

(This note is not part of the Regulations)

The following provisions of the Data (Use and Access) Act 2025 (c. 18) have been brought into force so far as they were not already in force (see section 142(2)(h) of that Act), by commencement Regulations made before the date of these Regulations. On the date these Regulations are made, the commencement date of the provision marked * has not been reached.

Provision	Date of Commencement	S.I. No.
Part 1	20th August 2025	2025/904
Part 2 (partially)	1st December 2025	2025/1213
section 72 (partially)	20th August 2025	2025/904
section 74	20th August 2025	2025/904
section 79	5th September 2025	2025/996
section 84	20th August 2025	2025/904
section 88	5th September 2025	2025/996
sections 89 and 90	17th November 2025	2025/996
sections 91 to 93	20th August 2025	2025/904
section 95	20th August 2025	2025/904
section 102	20th August 2025	2025/904
section 104	20th August 2025	2025/904
sections 106 to 109	20th August 2025	2025/904
section 110 (partially)	20th August 2025	2025/904
section 111	20th August 2025	2025/904
section 113	20th August 2025	2025/904
section 117 (partially)	20th August 2025	2025/904
section 124	30th September 2025	2025/982
section 125	20th August 2025	2025/904
section 129	20th August 2025	2025/904
sections 134 to 137	20th August 2025	2025/904
*section 138	6th February 2026	2026/31
Schedule 11 (partially)	20th August 2025	2025/904
Schedule 14	20th August 2025	2025/904

(1)

2025 c. 18.

(2)

2015 c. 20.

(3)

2018 c. 12.

(4)

Section 3(6) was amended by S.I. 2019/419.

(5)

See section 142(2)(h) of the Data (Use and Access) Act 2025. In addition, sections 72 and 110 of, and Schedule 11 to, that Act were partially commenced on 20th August 2025 by S.I. 2025/904.

(6)

See section 142(2)(h) of the Data (Use and Access) Act 2025.

(7)

Chapter III was amended by S.I. 2019/419.

(8)

Section 14 was amended by S.I. 2019/419.

(9)

Regulation 31 was amended by S.I. 2011/1208.

(10)

Regulation 5 was amended by S.I. 2011/1208.

(11)

Regulation 5b was amended by S.I. 2011/1208.