The Data (Use and Access) Act 2025 changes parts of the UK's data framework in stages. Businesses should identify the provisions relevant to their processing, rather than assume that the Act replaces the UK GDPR or removes existing responsibilities.
Key implementation points
Most of the Act's data-protection and privacy amendments took effect on 5 February 2026. The government has also introduced separate commencement measures for other parts of the Act, including the regulator's move to the Information Commission from 30 September 2026.
These changes do not provide a general permission to collect or share personal information. Businesses still need to assess the applicable legal basis, transparency, security and individual rights when handling data.
A complaints process is now required
The new data-protection complaints requirements took effect on 19 June 2026. Organisations should provide an accessible route for people to raise concerns, identify who will investigate and ensure that complaints are properly handled and answered under the applicable rules.
A privacy notice should match what the organisation actually does. Check that staff can recognise a data-protection complaint, pass it to the right person and retain an appropriate record of the response.
Review contracts and day-to-day practices
Map the personal data used by your business and identify key service providers. Review processing agreements, retention arrangements, staff access and procedures for responding to individual requests. Where a project involves data sharing, automated decisions or sensitive information, assess the particular legal requirements before launch.
The Act contains several distinct reforms. A headline about smart data or digital verification should not be treated as an immediate, universal obligation for every business.
Balaghi & Rose advises on commercial agreements and legal risk connected with business data. Contact info@balaghi-rose.com to discuss your requirements.
Updated 23 October 2026. General information only; advice depends on the facts and the law applicable to your matter.
