Data (Use and Access) Act 2025

__NOTOC__

The Data (Use and Access) Act 2025 (c. 18) (DUAA) is an act of the Parliament of the United Kingdom concerned with data protection. The act makes changes primarily to the operation of the UK's General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.Department for Science, Innovation and Technology, Data (Use and Access) Act factsheet: UK GDPR and DPA, published on 27 June 2025, accessed on 28 October 2025 The act passed into law on 19 June 2025.Information Commissioner's Office, Data (Use and Access) Act 2025, accessed on 28 October 2025

The provisions of the act were brought into effect in stages: the initial implementation of certain aspects of the new law took effect on 19 and 20 August 2025, and the process was substantially complete by 23 June 2026. The Information Commissioner's Office (ICO) is responsible for publishing regulatory guidance on the act.

Selected contents

National Underground Register The act places on a statutory footing the National Underground Register, which is operated by Ordnance Survey and provides digital map of underground pipes and cables in England, Wales and Northern Ireland.

Creation of intimate images The Sexual Offences Act 2003 is amended make an offence the creation, or the request for creation, of purported intimate images of another person who has not consented to this, for example by using generative AI. On 12 January 2026, technology minister Liz Kendall announced this would be brought into force that week, in response to the Grok AI image generation scandal.

Data protection complaints Organisations must provide a way for people to raise a data protection complaint, which must be acknowledged within 30 days.

Online services used by children An organisation providing an online service likely to be used by children must take children's needs into account when deciding how to use their data.

Notes

References

Data (Use and Access) Act 2025

Bron en licentie