Alert: UK Data Use and Access Act new provisions coming into force 20 August 2025

Published: 28th July 2025.

Several sections from the UK’s new Data Use and Access Act 2025 (DUAA 2025) will be coming into force on 20 August 2025. For more information on the DUAA 2025 as a whole see our alert, UK’s Data (Use and Access) Bill receives Royal Assent.

Some key highlights include:

Section 91: Information Commissioner’s role – duties of the Commissioner

This section introduces various objectives and topics for the Commissioner to consider in its tasks such as but not limited to:

• The principal objective to secure an appropriate level of protection for personal data and to promote public trust and confidence in the processing of personal data,
• The desirability of promoting innovation and competition, and
• The fact that children merit specific protection.

This section also includes a duty for the Commissioner to consult other regulators at appropriate times.

Section 104: Court procedure in connection with subject access requests

This section applies to when a court is required to determine whether a data subject is entitled to information under the right of access or right to data portability. The court may require the controller to make information available for inspection, however, the court cannot order disclosure unless and until the determination has been made in the data subject’s favour.

Additionally, this section also states that the court cannot order the controller to carry out searches more extensive than what’s reasonable and proportionate.

Section 111: Duty to notify the Commissioner of personal data breaches: time periods

The current (as of time of writing) legislation requires all data breaches to be reported within 24 hours. This section updates the PEC Regulations to require providers of public telecommunication services to report personal data breaches within 72 hours of becoming aware of the breach.

Section 117: the Information Commission

This section establishes the body of the Information Commission to replace the Information Commissioner’s Office (the ICO).

You can see the full list of sections that will come into force on 20 August 2025 at Legislation.gov.uk: The Data (Use and Access) Act 2025 (Commencement No. 1) Regulations 2025.

It’s also worth noting that section 78 of the DUAA 2025 is already in force, having come into force on the day the Act was passed. This section updates UK GDPR to confirm that in responding to a subject access request, controllers are only required to carry out reasonable and proportionate searches for personal information. This updated is very much aligned with what the ICO guidance has been saying for several years, and the additional clarity of adding it into statute is likely to be helpful to data controllers especially when dealing with nuisance subject access requests.

For further information:

More information about our work on data protection law and some recent projects, visit Data Protection.

You may also wish to benefit from our GDPR glossary for data related terms.

If you require advice on The UK Data Use and Access Act, Contact Us to arrange a consultation.