UK Data (Use & Access) Act — the verified record, live

The Data (Use and Access) Act 2025, which received Royal Assent in June 2025, is the UK's post-Brexit recalibration of its data protection framework. Rather than replacing UK GDPR, it amends it — alongside the Data Protection Act 2018 and PECR — with targeted changes: a list of recognised legitimate interests, relaxed rules on automated decision-making outside special category data, clarified purpose limitation and research provisions, adjusted subject access expectations, and new regimes for smart data schemes and digital verification services. It also restructures the regulator, converting the Information Commissioner's Office into an Information Commission with a board, and adjusts PECR enforcement so that fines align with UK GDPR levels. Provisions are being commenced in phases, with secondary legislation and ICO guidance filling in the operational detail. The central strategic question — whether the changes remain compatible with the UK's EU adequacy decisions, which were extended to allow the EU to assess the new law — makes this regime important well beyond UK privacy teams.

Every document below comes from the body that published it — regulators, courts, parliaments, official registers — with its true publication date and a link to the primary source.

as of 2026-08-31 · refreshed from scheduled releases

Latest developments

Publishing bodies represented

Frequently asked

What does the Data (Use and Access) Act change about UK GDPR?

It amends rather than replaces UK GDPR. Key changes include recognised legitimate interests that remove the balancing test for defined purposes, a more permissive regime for solely automated decision-making with safeguards, clarifications on purpose limitation and scientific research, rules on responding to subject access requests, and provisions on international transfers. It also establishes frameworks for smart data schemes and digital verification services.

Who enforces the Data (Use and Access) Act?

The Information Commissioner's Office, which the Act restructures into an Information Commission with a chair and board, remains the enforcer of UK data protection and PECR. Its fining powers under UK GDPR — up to £17.5 million or 4% of worldwide annual turnover — continue, and the Act raises PECR penalties for marketing and cookie breaches to equivalent levels.

Does the Act affect the UK's EU adequacy status?

That is the live question. The European Commission extended the UK's adequacy decisions so it could assess the reformed framework, and subsequently moved to renew adequacy on the basis that the UK still provides essentially equivalent protection. Organisations relying on free UK–EU data flows should nonetheless monitor the renewal cycle and any legal challenges, since adequacy remains reviewable and politically sensitive.

More: The Wire — this week across the record · all 38 ecosystems · analyst briefs on this regulation ↗