Data (Use and Access) Act 2025
| Act of Parliament | |
.svg) | |
| Long title | An Act to make provision about access to customer data and business data; to make provision about services consisting of the use of information to ascertain and verify facts about individuals; to make provision about the recording and sharing, and keeping of registers, of information relating to apparatus in streets; to make provision about the keeping and maintenance of registers of births and deaths; to make provision for the regulation of the processing of information relating to identified or identifiable living individuals; to make provision about privacy and electronic communications; to establish the Information Commission; to make provision about information standards for health and social care; to make provision about the grant of smart meter communication licences; to make provision about the disclosure of information to improve public service delivery; to make provision about the retention of information by providers of internet services in connection with investigations into child deaths; to make provision about providing information for purposes related to the carrying out of independent research into online safety matters; to make provision about the retention of biometric data; to make provision about services for the provision of electronic signatures, electronic seals and other trust services; to make provision about works protected by copyright and the development of artificial intelligence systems; to make provision about the creation of purported intimate images; and for connected purposes. |
|---|---|
| Citation | 2025 c. 18 |
| Territorial extent | [b] |
| Dates | |
| Royal assent | 19 June 2025 |
| Commencement | various[c] |
| Other legislation | |
| Amends |
|
Status: Current legislation | |
| Text of statute as originally enacted | |
| Revised text of statute as amended | |
| Text of the Data (Use and Access) Act 2025 as in force today (including any amendments) within the United Kingdom, from legislation.gov.uk. | |
The Data (Use and Access) Act 2025 (c. 18) (DUAA) is an act of the Parliament of the United Kingdom concerned with data protection. The act makes changes primarily to the operation of the UK's General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.[1] The act passed into law on 19 June 2025.[2]
The provisions of the act were brought into effect in stages:[3] the initial implementation of certain aspects of the new law took effect on 19 and 20 August 2025,[2] and the process was substantially complete by 23 June 2026.[4] The Information Commissioner's Office (ICO) is responsible for publishing regulatory guidance on the act.[1]
Selected contents
[edit source]National Underground Register
[edit source]The act places on a statutory footing the National Underground Register, which is operated by Ordnance Survey and provides digital map of underground pipes and cables in England, Wales and Northern Ireland.[5]
Creation of intimate images
[edit source]The Sexual Offences Act 2003 is amended make an offence the creation, or the request for creation, of purported intimate images of another person who has not consented to this, for example by using generative AI.[6] On 12 January 2026, technology minister Liz Kendall announced this would be brought into force that week, in response to the Grok AI image generation scandal.[7]
Data protection complaints
[edit source]Organisations must provide a way for people to raise a data protection complaint, which must be acknowledged within 30 days.[4]
Online services used by children
[edit source]An organisation providing an online service likely to be used by children must take children's needs into account when deciding how to use their data.[4]
Notes
[edit source]References
[edit source]- 1 2 Department for Science, Innovation and Technology, Data (Use and Access) Act factsheet: UK GDPR and DPA, published on 27 June 2025, accessed on 28 October 2025
- 1 2 Information Commissioner's Office, Data (Use and Access) Act 2025, accessed on 28 October 2025
- ↑ "Data law | UK Regulatory Outlook". Osborne Clarke. 25 September 2025. Retrieved 26 July 2026.
- 1 2 3 Thomas-Bryant, Keir (25 June 2026). "UK data protection changes in 2026: What businesses must do now". sage.com. Retrieved 26 July 2026.
- ↑ "National Underground Asset Register (NUAR)". GOV.UK. 27 April 2026. Retrieved 26 July 2026.
- ↑ Milmo, Dan; Gentleman, Amelia (9 January 2026). "Grok AI: is it legal to produce or post undressed images of people without their consent?". The Guardian. Retrieved 12 January 2026.
- ↑ "Creating AI sexualised images to become criminal offence this week". Sky News. Retrieved 13 January 2026.
Further reading
[edit source]- Information Commissioner's Office, The Data Use and Access Act 2025 (DUAA) - summary of the changes to data protection law, 2025
External links
[edit source]
The full text of Data (Use and Access) Act 2025 at Wikisource- Text of the Data (Use and Access) Act 2025 as in force today (including any amendments) within the United Kingdom, from legislation.gov.uk.
- Text of the Data (Use and Access) Act 2025 as originally enacted or made within the United Kingdom, from legislation.gov.uk.
- National Underground Register
.svg){kind=small}  | This article relating to law in the United Kingdom, or its constituent jurisdictions, is a stub. You can help Wikipedia by adding missing information. |