The Data (Use and Access) Act 2025 Arrived in Eight Instalments — and Two Sections Have Still Not Arrived

One Act, Nine Parts, and Only One of Them About Data Protection

The Data (Use and Access) Act 2025, 2025 c. 18, is routinely described as the UK's post-Brexit data protection reform. Its long title says otherwise. The Act makes provision about customer and business data, identity verification services, "the recording and sharing, and keeping of registers, of information relating to apparatus in streets," registers of births and deaths, the processing of personal data, privacy and electronic communications, the establishment of a new regulator, health and social care information standards, smart meter communication licences, public service delivery, retention of information in child-death investigations, research access to online safety data, retention of biometric data, trust services, copyright and artificial intelligence, and the creation of purported intimate images.

Those become 144 sections across nine parts. Data protection is Part 5, Chapter 1 — sections 66 to 108. The other eight parts have their own subject matter, their own sponsoring interests and, as it turns out, their own commencement timetables.

What Section 142 Switched On By Itself

Section 142(1) sets the default: except as otherwise provided, the Act "comes into force on such day as the Secretary of State may by regulations appoint." The exceptions are short.

Section 142(2) brought into force at Royal Assent on 19 June 2025 only section 66 (which defines "the 2018 Act" and "the UK GDPR"), section 78 (searches in response to data subjects' requests), Part 1 of Schedule 16 on smart meter communication licences with the related part of section 122, the three biometric retention sections 126 to 128, Part 8 itself, and — the provision that explains the pattern that followed — "any other provision of this Act … so far as it confers power to make regulations or is otherwise necessary for enabling the exercise of such a power."

Section 142(3) added a two-month delay for four provisions: section 69 on consent to law enforcement processing, section 82 on logging, and sections 96 and 97 on the Commissioner's notices and power to require documents. Section 142(4) ties Part 2 of Schedule 16 to the first regulations made under a provision the same Schedule inserts into the Energy Act 2008.

That is the whole of what the Act did to itself. A great many of its sections show a commencement note on legislation.gov.uk reading "in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)" — which records only that the power to make regulations under that section became exercisable, not that the section's substance applies.

Eight Commencement Instruments in Nine Months

The Secretary of State has since made eight commencement instruments, each published on legislation.gov.uk.

• S.I. 2025/904 (C. 40), made 21 July 2025, brought Part 1 and a long list of Part 5 and Part 7 provisions into force on 20 August 2025
• S.I. 2025/982 (C. 47) commenced section 124 — retention of information in connection with the death of a child — on 30 September 2025
• S.I. 2025/996 (C. 48) commenced sections 79 and 88 on 5 September 2025 and sections 89 and 90 on 17 November 2025, with transitional savings
• S.I. 2025/1213 (C. 62) commenced Part 2, digital verification services, on 1 December 2025 — "except sections 45 to 48"
• S.I. 2026/31 (C. 4) commenced section 138, on purported intimate images of adults, on 6 February 2026
• S.I. 2026/82 (C. 10) commenced the bulk of the data protection and privacy provisions on 5 February 2026, and section 103 with Schedule 10 on 19 June 2026
• S.I. 2026/126 (C. 12) commenced section 123 on 12 February 2026, alongside Digital Economy Act 2017 provisions for Northern Ireland
• S.I. 2026/317 (C. 25) commenced paragraph 32 of Schedule 11 on 31 March 2026, alongside a provision of the Victims and Prisoners Act 2024

Two of the eight are shared instruments doing work for another Act as well, which is why a search for the Act's own name does not find all of them. Each instrument from the second onwards carries a cumulative table headed "NOTE AS TO EARLIER COMMENCEMENT Regulations," which is the most reliable published index of what was in force when.

5 February 2026 Was the Data Protection Date

S.I. 2026/82 is the instrument that matters most to anyone reading the UK GDPR. Its regulation 2 commenced, on 5 February 2026, sections 67, 68, 70, 71, 72, 73, 75, 76, 77, 80, 81, 83, 85, 86, 87, 94, 98, 99, 100, 101, 105, 110, 112, 114, 115, 116, 120 and 121, together with Schedules 4 to 9, Schedule 11 apart from one paragraph, and Schedules 12, 13 and 15.

In other words the recognised legitimate interests ground, the purpose limitation rules, the automated decision-making replacement, the children's design provision, the international transfer test and the research provisions all began to apply on a single Thursday more than seven months after the Act was passed. Anything written about those changes between June 2025 and February 2026 was describing text that had been enacted but was not yet operative.

Regulation 3 of the same instrument held one provision back further: section 103 and Schedule 10, on complaints by data subjects, were given 19 June 2026 — the Act's first anniversary. Regulation 4 saves the old response deadlines for requests a controller had already received.

The PEC Regulations Changed on the Same Day

Three of the sections commenced on 5 February 2026 amend the Privacy and Electronic Communications (EC Directive) Regulations rather than the UK GDPR, and they are easy to miss in a list dominated by data protection.

Section 112 replaces regulation 6 outright. The new prohibition on storing information or gaining access to information stored in terminal equipment is expressed "[s]ubject to Schedule A1," a schedule of exceptions inserted by Schedule 12 of the Act, and is defined to include instigating the storage or access and to include "collecting or monitoring information automatically emitted by the terminal equipment." A new regulation 6A gives the Secretary of State power to add, vary or omit exceptions by statutory instrument after consultation.

Section 114 inserts a new paragraph (3A) into regulation 22, extending the soft opt-in to charities. It applies where the sole purpose of the marketing is to further the charity's charitable purposes, the contact details were obtained when the recipient expressed an interest in or offered support to those purposes, and a free means of refusal was offered at collection and in each subsequent message. "Charity" is defined by reference to the Charities Act 2011, the Charities Act (Northern Ireland) 2008 and the Scottish Charity Register.

Section 115 rewrites the Commissioner's enforcement powers under those Regulations, including repealing the audit provision at regulation 5B and adding Northern Ireland recovery routes for fixed monetary penalties.

The Information Commission Exists; the Commissioner Has Not Been Abolished

Part 6 replaces the regulator, and it is the clearest example of an Act that is only partly in force. Section 117 inserts a new section 114A into the Data Protection Act 2018 providing that "[a] body corporate called the Information Commission is established," and it came into force on 20 August 2025 apart from one subsection. Section 120, on the transfer of property, commenced on 5 February 2026.

Section 118, whose subsection (1) reads "[t]he office of Information Commissioner is abolished" and which would omit section 114 of and Schedule 12 to the 2018 Act, carries a single commencement note: "S. 118 not in force at Royal Assent, see s. 142(1)," with nothing after it. Section 119, which transfers functions to the Commission, records the same. On the face of the register the corporate body exists, the office it is to replace has not been abolished, and the functions have not moved.

What Is Still Not in Force

The contents page states that the Act "is up to date with all changes known to be in force on or before 05 September 2026," and adds that "[t]here are changes that may be brought into force at a future date." Reading the individual section notes rather than the summary, the uncommenced provisions include sections 45 to 48 — the information gateway allowing public authorities, including the revenue authorities, to disclose information to registered digital verification providers, expressly carved out of the Part 2 commencement — sections 118 and 119 above, section 131 on removing recognition of EU standards, and Part 4 on the form and keeping of registers of births and deaths, where sections 61, 62 and 65 all show no commencement.

Part 3, on the National Underground Asset Register, shows sections 56 to 58 in force "for specified purposes" only, which under section 142(2)(h) means the regulation-making powers. The register itself awaits those regulations.

None of this is unusual for a statute of this size, and none of it is hidden: legislation.gov.uk records the position section by section. It is simply not visible from the Act's text, from its long title, or from any summary that treats "the Data (Use and Access) Act 2025" as a single event with a single date.

Frequently Asked Questions