See Full Document Text
Status: This is the original version (as it was originally made). This
item of legislation is currently only available in its original format.
STATUTORY INSTRUMENTS
2026 No. 82 (C. 10)
DATA
DATA PROTECTION
ELECTRONIC COMMUNICATIONS
The Data (Use and Access) Act 2025 (Commencement No. 6
and Transitional and Saving Provisions) Regulations 2026
Made - - - - 29th January 2026
The Secretary of State makes these Regulations in exercise of the powers conferred by sections
142(1) and 143(1) of the Data (Use and Access) Act 2025(1) and section 104(1)(a) of the
Deregulation Act 2015(2).
Citation and interpretation
1.—(1) These Regulations may be cited as the Data (Use and Access) Act 2025 (Commencement
No. 6 and Transitional and Saving Provisions) Regulations 2026.
(2) In these Regulations—
“the 2018 Act” means the Data Protection Act 2018(3);
“the 2025 Act” means the Data (Use and Access) Act 2025;
“the Commissioner” has the same meaning as in section 3(8) of the 2018 Act;
“controller” has the same meaning as in section 3(6) of the 2018 Act(4);
“data subject” has the same meaning as in section 3(5) of the 2018 Act.
Provisions of the 2025 Act coming into force on 5th February 2026
2. The following provisions of the 2025 Act, so far as not already in force(5), come into force
on 5th February 2026—
(a) section 67 (meaning of research and statistical purposes);
(1) 2025 c. 18.
(2) 2015 c. 20.
(3) 2018 c. 12.
(4) Section 3(6) was amended by S.I. 2019/419.
(5) See section 142(2)(h) of the Data (Use and Access) Act 2025. In addition, sections 72 and 110 of, and Schedule 11 to, that
Act were partially commenced on 20th August 2025 by S.I. 2025/904.Document Generated: 2026-02-03
Status: This is the original version (as it was originally made). This
item of legislation is currently only available in its original format.
(b) section 68 (consent to processing for the purposes of scientific research);
(c) section 70 (lawfulness of processing);
(d) section 71 (the purpose limitation);
(e) section 72 (processing in reliance on relevant international law);
(f) section 73 (elected representatives responding to requests);
(g) section 75 (fees and reasons for responses to data subjects’ requests about law enforcement
processing);
(h) section 76 (time limits for responding to data subjects’ requests);
(i) section 77 (information to be provided to data subjects);
(j) section 80 (automated decision-making);
(k) section 81 (data protection by design: children’s higher protection matters);
(l) section 83 (general processing and codes of conduct);
(m) section 85 (transfers of personal data to third countries and international organisations);
(n) section 86 (safeguards for processing for research etc purposes);
(o) section 87 (section 86: consequential provision);
(p) section 94 (manifestly unfounded or excessive requests to the Commissioner);
(q) section 98 (power of the Commissioner to require a report);
(r) section 99 (assessment notices: removal of OFSTED restriction);
(s) section 100 (interview notices);
(t) section 101 (penalty notices);
(u) section 105 (consequential amendments to the EITSET Regulations);
(v) section 110 (interpretation of the PEC Regulations);
(w) section 112 (storing information in the terminal equipment of a subscriber or user);
(x) section 114 (use of electronic mail for direct marketing by charities);
(y) section 115 (Commissioner’s enforcement powers);
(z) section 116 (codes of conduct);
(z1) section 120 (transfer of property etc to the Information Commission);
(z2) section 121 (information standards for health and adult social care in England);
(z3) section 130 (recognition of EU conformity assessment bodies);
(z4) section 132 (recognition of overseas trust products);
(z5) subsection (4) of section 133 (co-operation between supervisory authority and overseas
authorities);
(z6) Schedule 4 (lawfulness of processing: recognised legitimate interests);
(z7) Schedule 5 (purpose limitation: processing to be treated as compatible with original
purpose);
(z8) Schedule 6 (automated decision-making: minor and consequential amendments);
(z9) Schedule 7 (transfers of personal data to third countries etc: general processing);
(z10) Schedule 8 (transfers of personal data to third countries etc: law enforcement processing);
(z11) Schedule 9 (transfers of personal data to third countries etc: minor and consequential
amendments and transitional provision);
(z12) Schedule 11 (further minor provision about data protection), except paragraph 32;
2Document Generated: 2026-02-03
Status: This is the original version (as it was originally made). This
item of legislation is currently only available in its original format.
(z13) Schedule 12 (storing information in the terminal equipment of a subscriber or user);
(z14) Schedule 13 (privacy and electronic communications: Commissioner’s enforcement
powers);
(z15) Schedule 15 (information standards for health and adult social care in England).
Provisions of the 2025 Act coming into force on 19th June 2026
3. The following provisions of the 2025 Act, so far as not already in force(6), come into force
on 19th June 2026—
(a) section 103 (complaints by data subjects);
(b) Schedule 10 (complaints: minor and consequential amendments).
Savings provisions relating to section 76 (time limits for responding to data subjects’
requests)
4. The amendments made by section 76 of the 2025 Act do not apply in relation to—
(a) a case in which the controller received a request from a data subject under Chapter III of
the UK GDPR (rights of the data subject)(7) before 5th February 2026;
(b) a case in which the controller received a request from a data subject under Chapter 3 of
Part 3 of the 2018 Act (rights of the data subject) before 5th February 2026;
(c) a case in which the controller received a request from a data subject under Chapter 3 of
Part 4 of the 2018 Act (rights of the data subject) before 5th February 2026.
Saving provision relating to section 80 and Schedule 6 (automated decision-making)
5. The amendments made by section 80 of, and Schedule 6 to, the 2025 Act do not apply in
relation to any decision taken before 5th February 2026 to which Article 22(3) of the UK GDPR
(automated individual decision-making, including profiling) or section 14(8) or 50(2) of the 2018
Act (automated decision-making authorised by law: safeguards) applied.
Saving provision relating to section 101 (penalty notices)
6. The amendments made by section 101 of the 2025 Act do not apply in relation to a case where
a notice of intent, within the meaning of paragraph 2(1) of Schedule 16 (penalties) to the 2018 Act,
was given by the Commissioner to a person before 5th February 2026.
Transitional provision relating to section 103 and Schedule 10 (complaints by data subjects)
7. The duties in section 164A(3) and (4) of the 2018 Act (handling of complaints by data subjects
to controllers) inserted by section 103 of the 2025 Act apply only in relation to a complaint that is
received by the controller on or after the 19th June 2026.
(6) See section 142(2)(h) of the Data (Use and Access) Act 2025.
(7) Chapter III was amended by S.I. 2019/419.
(8) Section 14 was amended by S.I. 2019/419.
3Document Generated: 2026-02-03
Status: This is the original version (as it was originally made). This
item of legislation is currently only available in its original format.
Transitional provision relating to section 115 and Schedule 13 (Commissioner’s enforcement
powers): investigatory powers
8.—(1) On or after 5th February 2026, the Commissioner may exercise any investigatory powers
applied to the PEC Regulations by regulation 31(9) (as substituted by section 115(5) of the 2025
Act), regardless of when the conduct to which the exercise of that power relates occurred.
(2) Paragraph (1) does not authorise the imposition of any enforcement sanction in respect of an
act or omission occurring before 5th February 2026 (see the availability of enforcement sanctions
in regulation 11).
Saving provision for exercise of powers begun under the PEC Regulations before 5th
February 2026
9. Where, before 5th February 2026, the Commissioner has exercised a power conferred by the
PEC Regulations as they had effect immediately before that date, and that exercise has not been
cancelled or withdrawn, those Regulations continue to have effect for the purpose of completing
that exercise.
Saving provision for audits begun under regulations 5 and 5B of the PEC Regulations before
5th February 2026
10. Paragraph 6 of regulation 5 of the PEC Regulations(10) and regulation 5B of those
Regulations(11) continue to have effect for the purpose of completing any audit begun (and not
cancelled) before 5th February 2026.
Transitional and savings provisions for enforcement action
11.—(1) Where any act or omission constituting a breach of the PEC Regulations occurred before
5th February 2026, any enforcement action taken in respect of that act or omission must be taken
under those Regulations as they had effect immediately before that date.
(2) Where any act or omission constituting a breach of the PEC Regulations occurred on or after
5th February 2026, any enforcement action taken in respect of that act or omission must be taken
under those Regulations as amended by section 115 of, and Schedule 13 to, the 2025 Act.
(3) The PEC Regulations as they had effect immediately before 5th February 2026 continue to
have effect for the purposes of—
(a) imposing monetary penalties or other sanctions in respect of acts or omissions occurring
before that date; and
(b) bringing or determining appeals in relation to such penalties or sanctions.
Amendment of the 2018 Act
12.—(1) The 2018 Act is amended as follows.
(2) In section 183A (protection of prohibitions and restrictions etc on processing: relevant
enactments), in subsection (4), in the definition of “relevant enactment”, for “the day on which
section 106(2) the Data (Use and Access) Act 2025 comes into force” substitute “20th August 2025”.
(3) In section 183B (protection of prohibitions and restrictions etc on processing: other
enactments), in subsection (5)(b), for “the day on which section 106(2) of the Data (Use and Access)
Act 2025 comes into force” substitute “20th August 2025”.
(9) Regulation 31 was amended by S.I. 2011/1208.
(10) Regulation 5 was amended by S.I. 2011/1208.
(11) Regulation 5b was amended by S.I. 2011/1208.
4Document Generated: 2026-02-03
Status: This is the original version (as it was originally made). This
item of legislation is currently only available in its original format.
(4) In section 186A (protection of data subject’s rights: further provision), in subsection (5), for
“the day on which section 106(4) of the Data (Use and Access) Act 2025 comes into force” substitute
“20th August 2025”.
Ian Murray
Minister of State
Department for Science, Innovation and
29th January 2026 Technology
5Document Generated: 2026-02-03
Status: This is the original version (as it was originally made). This
item of legislation is currently only available in its original format.
EXPLANATORY NOTE
(This note is not part of the Regulations)
These are the sixth commencement regulations made under the Data (Use and Access) Act 2025
(c. 18) (“the 2025 Act”).
Regulation 2 brings into force specified provisions of the 2025 Act on 5th February 2026.
Regulation 3 brings into force section 103 of, and Schedule 10 to, the 2025 Act on 19th June 2026.
Regulation 4 makes savings provisions in respect of time limits for responses to data subjects’
requests under the UK GDPR and the Data Protection Act 2018 (c. 12) (“the 2018 Act”). Where
a controller received a request before section 76 of the 2025 Act comes into force, the time limits
previously in force continue to apply.
Regulation 5 provides that the changes to the UK GDPR and the 2018 Act made by section 80 of
the 2025 Act apply only to decisions taken on or after section 80 comes into force.
Regulation 6 provides that the changes made to the penalty notice provisions in the 2018 Act made
by section 101 of the 2025 Act do not apply where the Information Commissioner has already issued
a notice of intent before that section comes into force. In such cases, the previous penalty provisions
continue to apply.
Regulation 7 makes transitional provisions for complaints by data subjects to controllers. The new
duties on controllers to handle complaints from data subjects at section 164(A)(3) and (4) of the 2018
Act as inserted by section 103 of the 2025 Act apply only to complaints submitted to the controller
on or after section 103 comes into force. Complaints made before that date continue to be handled
under the previous arrangements.
Regulations 8 to 11 make transitional and saving provision in connection with the coming into
force of section 115 of the 2025 Act, which amends the enforcement regime under the Privacy
and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426) (“the PEC
Regulations”).
Regulation 8 provides that the Information Commissioner can exercise investigatory powers applied
to the PEC Regulations by regulation 31 (as substituted by section 115(5) of the 2025 Act) in relation
to conduct that took place before 5th February 2026 but clarifies that enforcement sanctions are
determined by regulation 11.
Regulations 9 and 10 preserve the effect of the PEC Regulations for the purpose of completing the
exercise of investigatory powers and audits begun before commencement.
The provisions governing the completion of such audits continue to apply where an audit was begun
(and not cancelled) before that date.
Regulation 11 determines the applicable enforcement regime by requiring enforcement action
(including the imposition of sanctions) to be taken under the PEC Regulations as they had effect
immediately before commencement where the relevant conduct occurred before that date, and under
the PEC Regulations as amended where the conduct occurred on or after commencement.
Regulation 12 makes amendments to the 2018 Act to update specified commencement references.
An impact assessment has not been prepared for this instrument as a full impact assessment was
published in relation to the provisions in the Data (Use and Access) Bill. Copies can be obtained from
the UK Government website at https://www.gov.uk/government/publications/data-use-and-access-
6Document Generated: 2026-02-03
Status: This is the original version (as it was originally made). This
item of legislation is currently only available in its original format.
bill-supporting-documents or from the Department for Science, Innovation and Technology at 22-26
Whitehall, London, SW1A 2EG, United Kingdom.
NOTE AS TO EARLIER COMMENCEMENT REGULATIONS
(This note is not part of the Regulations)
The following provisions of the Data (Use and Access) Act 2025 (c. 18) have been brought into
force so far as they were not already in force (see section 142(2)(h) of that Act), by commencement
Regulations made before the date of these Regulations. On the date these Regulations are made, the
commencement date of the provision marked * has not been reached.
Provision Date of Commencement S.I. No.
Part 1 20th August 2025 2025/904
Part 2 (partially) 1st December 2025 2025/1213
section 72 (partially) 20th August 2025 2025/904
section 74 20th August 2025 2025/904
section 79 5th September 2025 2025/996
section 84 20th August 2025 2025/904
section 88 5th September 2025 2025/996
sections 89 and 90 17th November 2025 2025/996
sections 91 to 93 20th August 2025 2025/904
section 95 20th August 2025 2025/904
section 102 20th August 2025 2025/904
section 104 20th August 2025 2025/904
sections 106 to 109 20th August 2025 2025/904
section 110 (partially) 20th August 2025 2025/904
section 111 20th August 2025 2025/904
section 113 20th August 2025 2025/904
section 117 (partially) 20th August 2025 2025/904
section 124 30th September 2025 2025/982
section 125 20th August 2025 2025/904
section 129 20th August 2025 2025/904
sections 134 to 137 20th August 2025 2025/904
*section 138 6th February 2026 2026/31
Schedule 11 (partially) 20th August 2025 2025/904
Schedule 14 20th August 2025 2025/904
7