Data (Use and Access) Act 2025: What's Confirmed So Far

24 September 2026 · 3 minute read

The Data (Use and Access) Act 2025 commenced most of its data protection changes on 5 February 2026, with a new complaints duty from 19 June 2026. It received Royal Assent on 19 June 2025 and is commencing in stages by regulations, rather than all at once (often written without brackets, as the Data Use and Access Act). This guide sticks to what we can currently confirm: the main commencement date, the new complaints duty, and the subject access changes it puts on a statutory footing. This is general awareness information, not legal advice, stated as at September 2026 and last reviewed 24 September 2026.

Data (Use and Access) Act summary

Most of the main data protection changes the Data (Use and Access) Act 2025 makes in Part 5 came into force on 5 February 2026, under the Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, SI 2026/82 (legislation.gov.uk). The Act also puts two existing pieces of ICO guidance onto a statutory footing: that the right of subject access extends to what a controller can find through a reasonable and proportionate search, and the “stopping the clock” rule while a controller seeks clarification on a request. Other Part 5 changes exist beyond these, and we are not stating a position on them here until they are separately verified.

Most Data (Use and Access) Act changes: 5 February 2026.

The complaints duty

From 19 June 2026, a new section 164A of the Data Protection Act 2018 (commenced by regulation 3 of SI 2026/82) requires a controller to make it easier for people to make data protection complaints, including by providing an electronic complaints form. A controller must acknowledge a complaint within 30 days of receipt, and must, without undue delay, take appropriate steps to respond and tell the complainant the outcome.

Complaints acknowledged within 30 days, from 19 June 2026.

Data (Use and Access) Act 2025 commencement dates

Two dates matter most so far: 5 February 2026 for most of the main Part 5 data protection changes, and 19 June 2026 for the complaints duty. Both commenced under SI 2026/82, made under the Data (Use and Access) Act 2025, which itself received Royal Assent on 19 June 2025.

Subject access request changes

The Act’s statutory footing for “reasonable and proportionate search” and “stopping the clock” affects how a controller handles a subject access request, and when its response is due. If your organisation handles these requests, see our full guide to the subject access request time limit, including a calculator for your exact deadline.

Train your team on this

Beyond GDPR: The 2026 UK Data Rules You Can’t Ignore covers this Act alongside the other UK data rules that changed in 2026. See the course, or browse all our governance and compliance courses.

Frequently asked questions

When did the Data (Use and Access) Act 2025 come into force?

It received Royal Assent on 19 June 2025 and is commencing in stages. Most of the main Part 5 data protection changes came into force on 5 February 2026, and the new complaints duty came into force on 19 June 2026.

What is the Data (Use and Access) Act's complaints duty?

From 19 June 2026, a controller must provide an electronic complaints form, acknowledge a complaint within 30 days, and respond without undue delay, telling the complainant the outcome.

Does the Data (Use and Access) Act change subject access request deadlines?

It puts "reasonable and proportionate search" and "stopping the clock" on a statutory footing; both previously existed as ICO guidance. See our subject access request time limit guide for the deadline rules themselves.