The Data (Use and Access) Act 2025, which received Royal Assent on 19 June 2025, is being brought into force by the government through a four-stage commencement plan. Some provisions, including regulation-making powers, came into force automatically.
Stage 1 regulations, which commenced on 20 August 2025, included technical provisions and new statutory objectives for the Information Commissioner's Office. These regulations also require the government to prepare a progress update and report on copyright works and artificial intelligence systems.
Stage 2 regulations, which commenced on 30 September 2025, included measures on the retention of information by internet service providers in connection with the death of a child. Further Stage 2 regulations amended parts of the Data Protection Act 2018 concerning data processing for law enforcement and intelligence services.
Stage 3 regulations brought the majority of digital identity and attributes trust framework measures into force on 1 December 2025. Additionally, new offences related to creating or requesting purported intimate images without consent commenced on 6 February 2026, and most data protection and privacy provisions in Part 5 of the Act came into force on 5 February 2026.
Stage 4 regulations, which commenced on 31 March 2026, included provisions extending information-sharing powers for public authorities to support businesses and charities. These regulations also amended the right of erasure in the UK GDPR, adding a new ground for data subjects to request erasure of personal data processed due to an unfounded allegation by a malicious person.