Data (Use and Access) Act 2025 changes to UK GDPR
The Data (Use and Access) Act 2025 amended the UK GDPR, the Data Protection Act 2018 and the electronic privacy rules. Most changes began on 5 February 2026: recognised legitimate interests, a new subject access clock, wider automated decisions and a new transfer test. A complaints duty followed on 19 June 2026, and the Information Commission on 30 September 2026.
The requirement in plain English
The Act received Royal Assent on 19 June 2025 and came into force in stages. Its data protection provisions are in Part 5. Most of them commenced on 5 February 2026 under the Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026. The EU GDPR is unchanged, so on these points the two regimes now differ.
| Change | What it means for you | Where in the law | In force |
|---|---|---|---|
| Recognised legitimate interests | A seventh lawful basis for a closed list of public-interest purposes, with no balancing test; direct marketing, intra-group administration and network security are named as examples of ordinary legitimate interests | Data (Use and Access) Act 2025 section 70; UK GDPR Article 6(1)(ea) and Annex 1 | 5 February 2026 |
| Purpose limitation | A new Article 8A sets out when further processing is compatible with the original purpose, with listed compatible purposes in Annex 2 | Data (Use and Access) Act 2025 section 71 | 5 February 2026 |
| Subject access clock | The month runs from the latest of receipt, identity information or fee, and pauses while you wait for clarification of a broad request | Data (Use and Access) Act 2025 section 76; Article 12A of the UK GDPR | 5 February 2026 |
| Reasonable and proportionate search | Access is limited to what a reasonable and proportionate search finds | Data (Use and Access) Act 2025 section 78; UK GDPR Article 15(1A) | Treated as in force from 1 January 2024 |
| Privacy notice exceptions | New exceptions for research and for disproportionate effort | Data (Use and Access) Act 2025 section 77 | 5 February 2026 |
| Automated decision-making | Solely automated significant decisions are allowed with safeguards, except on special category data without extra grounds | Data (Use and Access) Act 2025 section 80; Articles 22A to 22D replace UK GDPR Article 22 | 5 February 2026 |
| Children’s higher protection | Online services likely to be used by children must weigh children’s needs when designing data protection measures | Data (Use and Access) Act 2025 section 81; Article 25 | 5 February 2026 |
| International transfers | Approval by regulations and the data protection test replace adequacy; safeguards need a reasonable and proportionate assessment | Data (Use and Access) Act 2025 section 85; UK GDPR Article 45B | 5 February 2026 |
| Complaints to controllers | You must have a way to receive complaints, acknowledge each within 30 days and respond without undue delay | Data (Use and Access) Act 2025 section 103; Data Protection Act 2018 section 164A | 19 June 2026 |
| Cookies and marketing | New consent exceptions for analytics, appearance and security cookies, and the soft opt-in extended to charities | Data (Use and Access) Act 2025 section 112 and section 114 | 5 February 2026 |
| Electronic communications enforcement | Breaches of the electronic communications rules now face the UK GDPR penalty regime and investigation powers | Data (Use and Access) Act 2025 section 115 | 5 February 2026 |
| The regulator | The Information Commissioner’s office is abolished and its functions pass to the Information Commission, which keeps the ICO name | Data (Use and Access) Act 2025 section 118 | 30 September 2026 |
Three points deserve care. The new lawful basis is narrow: it does not cover your own marketing or analytics (UK GDPR Article 6(1)(f) still does, with the balancing test). The automated decision-making rules relax a prohibition into a set of safeguards: you must tell people about significant automated decisions, let them make representations, get human intervention and contest the decision. And the complaints duty gives people a formal route to you before they go to the regulator.
This is guidance to help you understand the requirement, not legal advice.
What good looks like
A 20-person UK software company with no data protection officer runs a single change review. The operations manager lists each change in the table above and asks which of the company’s documents and processes it touches.
The rights procedure gets the new clock rules, a line on clarification requests, and a complaints step with a 30-day acknowledgement. A web form for complaints has been live since June 2026. The privacy notice is checked for automated decisions: the company’s credit-check feature makes significant decisions, so the notice and the product now explain the right to human review. Transfer risk assessments are reviewed against the new test and re-dated. The cookie banner is reviewed against the new analytics exception, and the analytics cookie moves out of the consent wall only once the conditions are met.
Each update is recorded as a document revision that names the Act as the reason, so an auditor can see what changed and when.
Evidence an auditor expects
- Change review: usual; a dated note of which changes applied to you and what you did.
- Updated rights procedure: required in substance; the auditor checks the clock, pause and search rules match the amended text.
- Complaints process: required from 19 June 2026; the auditor looks for the route, acknowledgements within 30 days and outcomes.
- Automated decision records: required where you make significant automated decisions; the auditor checks the safeguards are in place and explained.
- Lawful basis records: required; any reliance on recognised legitimate interests must name the Annex 1 condition.
- Cookie assessments: usual; the auditor checks any cookie moved out of consent meets the new conditions.
Common mistakes
Treating recognised legitimate interests as a marketing basis
The new basis covers crime, safeguarding, emergencies, national security and disclosures to public bodies. Marketing stays under ordinary legitimate interests, with a written balancing test.
Applying UK changes to EU processing
A UK company with EU customers under the EU GDPR gets none of these flexibilities for that processing. Keep the stricter rule where both regimes apply, or document which applies to each activity.
Reading the search limit as permission to search less
The search limit in UK GDPR Article 15(1A) protects you from impossible searches, not from ordinary ones. Record what you searched and why you stopped.
Missing the complaints duty
Many organisations handle complaints about data informally through customer service. From 19 June 2026 you need an identifiable route, acknowledgement within 30 days and a record of outcomes.
Dropping consent for all analytics
The new cookie exceptions come with conditions: clear information, a simple way to object, and limits on sharing. Check each tool against them before you remove it from the consent banner.
How Sted helps
- Sted’s catalogue records UK GDPR in its current form, as amended by the Data (Use and Access) Act 2025.
- The policy and procedure text in Sted’s knowledge base does not yet name the Act’s specific changes, such as recognised legitimate interests or the complaints duty.
- Sted treats UK GDPR, and separately EU GDPR, as applying when you process any personal data and are established in that territory or offer goods or services to, or monitor, people there; it reads your controller and processor roles from your processing activities, notes when an Article 27 representative is needed, and holds its confidence at medium until a processing activity is recorded.
- When a generation run changes Sted’s recommendations for a document you have worked on, Sted keeps your version, prepares a new draft beside it and raises one review task for the document’s owner, which approval closes.
- Approving sets an effective date and a review date, which starts at the effective date plus the document’s review frequency; a review task opens 30 days before the review date and turns overdue after it.
Sted does not change your approved documents on its own. You decide how each change in the law applies to you and approve the revision.
Related guides and terms
- UK GDPR and EU GDPR: the hub that compares the two regimes.
- Lawful basis for processing: recognised legitimate interests in context.
- Individual rights and subject access requests: the new clock and search rules in practice.
- International data transfers: the UK’s new transfer test.
- Lawful basis: the term defined.
- Document control: recording each change as a revision.
Frequently asked questions
Did the Data (Use and Access) Act change the EU GDPR?
No. It is a UK Act and changes only UK law. If you also process data under the EU GDPR, that regulation is unchanged, so the UK-only flexibilities, such as recognised legitimate interests, do not help with your EU processing.
Do I need to rewrite my privacy policies because of the Act?
Most organisations need targeted updates rather than a rewrite. Check your rights procedure for the new clock and complaints duty, your privacy notice if you use automated decisions or rely on the new bases, your transfer assessments, and your cookie banner if you use analytics.