Citation and interpretation

1.—(1) These Regulations may be cited as the Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026.

(2) In these Regulations—

“ the 2018 Act ” means the Data Protection Act 2018 ( 3 );

“ the 2025 Act ” means the Data (Use and Access) Act 2025 ;

“ the Commissioner ” has the same meaning as in section 3(8) of the 2018 Act;

“ controller ” has the same meaning as in section 3(6) of the 2018 Act( 4 );

“ data subject ” has the same meaning as in section 3(5) of the 2018 Act.

Provisions of the 2025 Act coming into force on 5th February 2026

2. The following provisions of the 2025 Act, so far as not already in force(5), come into force on 5th February 2026—

(a)section 67 (meaning of research and statistical purposes);

(b)section 68 (consent to processing for the purposes of scientific research);

(c)section 70 (lawfulness of processing);

(d)section 71 (the purpose limitation);

(e)section 72 (processing in reliance on relevant international law);

(f)section 73 (elected representatives responding to requests);

(g)section 75 (fees and reasons for responses to data subjects’ requests about law enforcement processing);

(h)section 76 (time limits for responding to data subjects’ requests);

(i)section 77 (information to be provided to data subjects);

(j)section 80 (automated decision-making);

(k)section 81 (data protection by design: children’s higher protection matters);

(l)section 83 (general processing and codes of conduct);

(m)section 85 (transfers of personal data to third countries and international organisations);

(n)section 86 (safeguards for processing for research etc purposes);

(o)section 87 (section 86: consequential provision);

(p)section 94 (manifestly unfounded or excessive requests to the Commissioner);

(q)section 98 (power of the Commissioner to require a report);

(r)section 99 (assessment notices: removal of OFSTED restriction);

(s)section 100 (interview notices);

(t)section 101 (penalty notices);

(u)section 105 (consequential amendments to the EITSET Regulations);

(v)section 110 (interpretation of the PEC Regulations);

(w)section 112 (storing information in the terminal equipment of a subscriber or user);

(x)section 114 (use of electronic mail for direct marketing by charities);

(y)section 115 (Commissioner’s enforcement powers);

(z)section 116 (codes of conduct);

(z1)section 120 (transfer of property etc to the Information Commission);

(z2)section 121 (information standards for health and adult social care in England);

(z3)section 130 (recognition of EU conformity assessment bodies);

(z4)section 132 (recognition of overseas trust products);

(z5)subsection (4) of section 133 (co-operation between supervisory authority and overseas authorities);

(z6)Schedule 4 (lawfulness of processing: recognised legitimate interests);

(z7)Schedule 5 (purpose limitation: processing to be treated as compatible with original purpose);

(z8)Schedule 6 (automated decision-making: minor and consequential amendments);

(z9)Schedule 7 (transfers of personal data to third countries etc: general processing);

(z10)Schedule 8 (transfers of personal data to third countries etc: law enforcement processing);

(z11)Schedule 9 (transfers of personal data to third countries etc: minor and consequential amendments and transitional provision);

(z12)Schedule 11 (further minor provision about data protection), except paragraph 32;

(z13)Schedule 12 (storing information in the terminal equipment of a subscriber or user);

(z14)Schedule 13 (privacy and electronic communications: Commissioner’s enforcement powers);

(z15)Schedule 15 (information standards for health and adult social care in England).

Provisions of the 2025 Act coming into force on 19th June 2026

3. The following provisions of the 2025 Act, so far as not already in force(6), come into force on 19th June 2026—

(a)section 103 (complaints by data subjects);

(b)Schedule 10 (complaints: minor and consequential amendments).

Savings provisions relating to section 76 (time limits for responding to data subjects’ requests)

4. The amendments made by section 76 of the 2025 Act do not apply in relation to—

(a)a case in which the controller received a request from a data subject under Chapter III of the UK GDPR (rights of the data subject)(7) before 5th February 2026;

(b)a case in which the controller received a request from a data subject under Chapter 3 of Part 3 of the 2018 Act (rights of the data subject) before 5th February 2026;

(c)a case in which the controller received a request from a data subject under Chapter 3 of Part 4 of the 2018 Act (rights of the data subject) before 5th February 2026.

Saving provision relating to section 80 and Schedule 6 (automated decision-making)

5. The amendments made by section 80 of, and Schedule 6 to, the 2025 Act do not apply in relation to any decision taken before 5th February 2026 to which Article 22(3) of the UK GDPR (automated individual decision-making, including profiling) or section 14(8) or 50(2) of the 2018 Act (automated decision-making authorised by law: safeguards) applied.

Saving provision relating to section 101 (penalty notices)

6. The amendments made by section 101 of the 2025 Act do not apply in relation to a case where a notice of intent, within the meaning of paragraph 2(1) of Schedule 16 (penalties) to the 2018 Act, was given by the Commissioner to a person before 5th February 2026.

Transitional provision relating to section 103 and Schedule 10 (complaints by data subjects)

7. The duties in section 164A(3) and (4) of the 2018 Act (handling of complaints by data subjects to controllers) inserted by section 103 of the 2025 Act apply only in relation to a complaint that is received by the controller on or after the 19th June 2026.

Transitional provision relating to section 115 and Schedule 13 (Commissioner’s enforcement powers): investigatory powers

8.—(1) On or after 5th February 2026, the Commissioner may exercise any investigatory powers applied to the PEC Regulations by regulation 31(9) (as substituted by section 115(5) of the 2025 Act), regardless of when the conduct to which the exercise of that power relates occurred.

(2) Paragraph (1) does not authorise the imposition of any enforcement sanction in respect of an act or omission occurring before 5th February 2026 (see the availability of enforcement sanctions in regulation 11).

Saving provision for exercise of powers begun under the PEC Regulations before 5th February 2026

9. Where, before 5th February 2026, the Commissioner has exercised a power conferred by the PEC Regulations as they had effect immediately before that date, and that exercise has not been cancelled or withdrawn, those Regulations continue to have effect for the purpose of completing that exercise.

Saving provision for audits begun under regulations 5 and 5B of the PEC Regulations before 5th February 2026

10. Paragraph 6 of regulation 5 of the PEC Regulations(10) and regulation 5B of those Regulations(11) continue to have effect for the purpose of completing any audit begun (and not cancelled) before 5th February 2026.

Transitional and savings provisions for enforcement action

11.—(1) Where any act or omission constituting a breach of the PEC Regulations occurred before 5th February 2026, any enforcement action taken in respect of that act or omission must be taken under those Regulations as they had effect immediately before that date.

(2) Where any act or omission constituting a breach of the PEC Regulations occurred on or after 5th February 2026, any enforcement action taken in respect of that act or omission must be taken under those Regulations as amended by section 115 of, and Schedule 13 to, the 2025 Act.

(3) The PEC Regulations as they had effect immediately before 5th February 2026 continue to have effect for the purposes of—

(a)imposing monetary penalties or other sanctions in respect of acts or omissions occurring before that date; and

(b)bringing or determining appeals in relation to such penalties or sanctions.

Amendment of the 2018 Act

12.—(1) The 2018 Act is amended as follows.

(2) In section 183A (protection of prohibitions and restrictions etc on processing: relevant enactments), in subsection (4), in the definition of “relevant enactment”, for “the day on which section 106(2) the Data (Use and Access) Act 2025 comes into force” substitute “20th August 2025”.

(3) In section 183B (protection of prohibitions and restrictions etc on processing: other enactments), in subsection (5)(b), for “the day on which section 106(2) of the Data (Use and Access) Act 2025 comes into force” substitute “20th August 2025”.

(4) In section 186A (protection of data subject’s rights: further provision), in subsection (5), for “the day on which section 106(4) of the Data (Use and Access) Act 2025 comes into force” substitute “20th August 2025”.