United Kingdom. Data access / sharing. Act
DUAAData (Use and Access) Act 2025
Partly verified
Medium confidence.Exact commencement of Part 6 (Information Commission) unconfirmed: one tracker reports transfer of functions from 2026-09-30; ICO site title already reads 'Information Commission's Office'. DVS ss.45–48 and some smart data regulations may still be pending.
§1Summary
- Synopsis
A wide-ranging Act that amends UK GDPR, DPA 2018 and PECR, creates frameworks for sector 'smart data' schemes and trusted digital verification services, and restructures the ICO into a corporate Information Commission. Commencement is phased; the core data protection changes have applied since 5 February 2026.
- Key themes
- Unique features
Introduces a statutory trust framework for digital identity services, regulations-led smart data schemes beyond open banking, and the UK's own adequacy test ('not materially lower'), while keeping the UK broadly aligned enough to have EU adequacy renewed in December 2025.
- SaaS relevance
SaaS providers to UK users benefit from looser cookie, legitimate interest and ADM rules but must implement a complaints procedure and face PECR fines at GDPR level; identity/verification and data-portability vendors may fall within the DVS and smart data regimes.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- See UK GDPR / PECR
- DPO
- Conditional
- Cross-border transfers
- Amends UK GDPR Chapter V – new 'data protection test' for adequacy and safeguards
- Maximum penalty
- Applies UK GDPR levels; PECR now £17.5m or 4%
§3Dates
- Key dates
- Adopted
- In force
- Royal Assent 2025-06-19; Commencement No.1 2025-08-20 (Part 1 smart data framework, PECR s.111, ICO duties); No.3 2025-09-05 & 2025-11-17 (LPP, national security); No.2 2025-09-30 (OSA amendment); No.4 2025-12-01 (most of Part 2 digital verification services, except ss.45–48); No.6 (SI 2026/82) 2026-02-05 (main data protection and PECR reforms) and 2026-06-19 (s.103 complaints); Part 6 Information Commission – later commencement
§4Text and authority
- Text
- Authoritative text legislation.gov.uk
- Authority
- Information Commissioner's Office (ICO); Department for Science, Innovation and Technology (smart data, DVS)
§5Where it applies
- Domestic law of
- United Kingdom
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Exact commencement of Part 6 (Information Commission) unconfirmed: one tracker reports transfer of functions from 2026-09-30; ICO site title already reads 'Information Commission's Office'. DVS ss.45–48 and some smart data regulations may still be pending.