140
| Provision | Sub- provision | Title |
Is it currently in effect? |
Implementation Date |
Relevant Section of the Act (plus link) |
| Part 5 Data Protection and Privacy | |||||
| Chapter 1 Data Protection | |||||
| Terms used in this chapter | |||||
| 66 | The 2018 Act and the UK GDPR | Yes | 19 June 2025 | Section 142(2)(a) Data (Use and Access) Act 2025 | |
| Definitions in the UK GDPR and the 2018 Act | |||||
| 67 | Meaning of research and statistical purposes | Yes | 5 February 2026 | Regulation 2(a), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
| 68 | Consent to processing for the purposes of scientific research | Yes | 5 February 2026 | Regulation 2(b), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
| 69 | Consent to law enforcement processing | Yes | 20 August 2025 | Section 142(3)(a) Data (Use and Access) Act 2025 | |
| Data protection principles | |||||
| 70 | Lawfulness of processing | Yes | 5 February 2026 | Regulation 2(c), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
|
71 |
The purpose limitation |
Yes |
5 February 2026 |
Regulation 2(d), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
|
72 |
Except (3) and (7) |
Processing in reliance on relevant international law |
Yes |
20 August 2025 | Regulation 2(b), The Data (Use and Access) Act 2025 (Commencement No. 1) Regulations 2025 |
| 72 | (3) | Yes | 5 February 2026 | Regulation 2(e), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
| 72 | (7) | Yes | 5 February 2026 | Regulation 2(e), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
| Processing of special categories of personal data | |||||
| 73 | Elected representatives
responding to requests |
Yes | 5 February 2026 | Regulation 2(f), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
| 74 | Processing of special categories of personal data | Yes | 20 August 2025 | Regulation 2(c), The Data (Use and Access) Act 2025
(Commencement No. 1) Regulations 2025 |
|
|
Data subject’s rights |
|||||
| 75 | Fees and reasons for responses to data subjects’ requests about law enforcement processing | Yes | 5 February 2026 | Regulation 2(g), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
| 76 | Time limits for responding to data subjects’ requests | Yes * | 5 February 2026 | Regulation 2(h), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
| 77 | Information to be provided to data subjects | Yes | 5 February 2026 | Regulation 2(i), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
| 78 | Searches in response to data subjects’ requests | Yes | 19 June 2025 | Section 142(2)(b) Data (Use and Access) Act 2025 | |
| 79 | Data subjects’ rights to information: legal professional privilege exemption | Yes | 5 September 2025 | Regulation 2(1)(a), The Data (Use and Access) Act 2025
(Commencement No. 3 and Transitional and Saving Provisions) Regulations 2025 |
|
| Automated decision-making | |||||
| 80 | Automated decision-making | Yes* | 5 February 2026 | Regulation 2(j), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
|
Obligations of controllers |
|||||
| 81 | Data protection by design: children’s higher protection matters | Yes | 5 February 2026 | Regulation 2(k), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
| Logging of law enforcement processing | |||||
| 82 | Logging of law enforcement processing | Yes | 20 August 2025 | Section 142(3)(b) Data (Use and Access) Act 2025 | |
| Codes of conduct | |||||
| 83 | General processing and codes of conduct | Yes | 5 February 2026 | Regulation 2(l), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
| 84 | Law enforcement processing and codes of conduct | Yes | 20 August 2025 | Regulation 2(d), The Data (Use and Access) Act 2025
(Commencement No. 1) Regulations 2025 |
|
| International transfers of personal data | |||||
| 85 | Transfers of personal data to third countries and international organisations | Yes | 5 February 2026 | Regulation 2(m), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
| Safeguards for processing for research etc. purposes | |||||
| 86 | Safeguards for processing for research etc. purposes | Yes | 5 February 2026 | Regulation 2(n), The Data (Use and Access) | |
| Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|||||
| 87 | Section 86: consequential provision | Yes | 5 February 2026 | Regulation 2(o), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
| National security | |||||
| 88 | National security exemption | Yes | 5 September 2025 | Regulation 2(1)(b), The Data (Use and Access) Act 2025
(Commencement No. 3 and Transitional and Saving Provisions) Regulations 2025 |
|
| Intelligence services | |||||
| 89 | Joint processing by intelligence services and competent authorities | Yes | 17 November 2025 | Regulation 2(2)(a), The Data (Use and Access) Act 2025
(Commencement No. 3 and Transitional and Saving Provisions) Regulations 2025 |
|
| 90 | Joint processing:
consequential amendments |
Yes | 17 November 2025 | Regulation 2(2)(b), The Data (Use and Access) Act 2025
(Commencement No. 3 and Transitional and Saving Provisions) Regulations 2025 |
|
| Information Commissioner’s role | |||||
| 91 | Duties of the Commissioner in carrying out functions | Yes | 20 August 2025 | Regulation 2(e), The Data (Use and Access) Act 2025
(Commencement No. 1) Regulations 2025 |
|
| 92 | Codes of practice for the processing of personal data | Yes | 20 August 2025 | Regulation 2(f), The Data (Use and Access) Act 2025
(Commencement No. 1) Regulations 2025 |
|
| 93 | Codes of practice: panels and impact assessments | Yes | 20 August 2025 | Regulation 2(g), The Data (Use and Access) Act 2025
(Commencement No. 1) Regulations 2025 |
|
| 94 | Manifestly unfounded or excessive requests to the Commissioner | Yes | 5 February 2026 | Regulation 2(p), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
| 95 | Analysis of performance | Yes | 20 August 2025 | Regulation 2(h), The Data (Use and Access) Act 2025
(Commencement No. 1) Regulations 2025 |
|
| 96 | Notices from the Commissioner | Yes | 20 August 2025 | Section 142(3)(c) Data
(Use and Access) Act 2025 |
|
| Enforcement | |||||
| 97 | Power of the Commissioner to require documents | Yes | 20 August 2025 | Section 142(3)(d) Data
(Use and Access) Act 2025 |
|
| 98 | Power of the Commissioner to require a report | Yes | 5 February 2026 | Regulation 2(q), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
| 99 | Assessment notices: removal of OFSTED restriction | Yes | 5 February 2026 | Regulation 2(r), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
| 100 | Interview notices | Yes | 5 February 2026 | Regulation 2(s), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving (Provisions) Regulations 2026 |
|
| 101 | Penalty notices | Yes * | 5 February 2026 | Regulation 2(t), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
| 102 | Annual report on regulatory action | Yes | 20 August 2025 | Regulation 2(i), The Data (Use and Access) Act 2025
(Commencement No.1) Regulations 2025 |
|
| 103 | Complaints by data subjects | Yes * | 19 June 2026 | Regulation 3(a), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
| 104 | Court procedure in connection with subject access requests | Yes | 20 August 2025 | Regulation 2(j), The Data (Use and Access) Act 2025
(Commencement No. 1) Regulations 2025 |
|
| 105 | Consequential amendments to the EITSET Regulations | Yes | 5 February 2026 | Regulation 2(u), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
| Protection of prohibitions, restrictions and data subject’s rights | |||||
| 106 | Protection of prohibitions, restrictions and data subject’s rights | Yes | 20 August 2025 | Regulation 2(k), The Data (Use and Access) Act 2025
(Commencement No. 1) Regulations 2025 |
|
| Miscellaneous | |||||
| 107 | Regulations under the UK GDPR | Yes | 20 August 2025 | Regulation 2(l), The Data (Use and Access) Act 2025
(Commencement No. 1) Regulations 2025 |
|
| 108 | Further minor provision about data protection | Yes | 20 August 2025 | Regulation 2(m), The Data (Use and Access) Act 2025
(Commencement No. 1) Regulations 2025 |
|
| Chapter 2 Privacy and electronic communications | |||||
| 109 | The PEC Regulations | Yes | 20 August 2025 | Regulation 2(n), The Data (Use and Access) Act 2025
(Commencement No. 1) Regulations 2025 |
|
| 110 | (except (2)(a),
(2)(b) and (3)) |
Interpretation of the PEC Regulations | Yes | 20 August 2025 | Regulation 2(o), The Data (Use and Access) Act 2025
(Commencement No. 1) Regulations 2025 |
| 110 | (2)(a) | Yes | 5 February 2026 | Regulation 2(v), The
Data (Use and Access) Act 2025 (Commencement No6. and Transitional and Saving Provisions) Regulations 2026) |
|
| 110 | (2)(b) | Yes | 5 February 2026 | Regulation 2(v), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
| 110 | (3) | Yes | 5 February 2026 | Regulation 2(v), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
| 111 | Duty to notify the Commissioner of personal data breach: time periods | Yes | 20 August 2025 | Regulation 2(p), The Data (Use and Access) Act 2025
(Commencement No. 1) Regulations 2025 |
|
| 112 | Storing Information in the terminal equipment of a subscriber or user | Yes | 5 February 2026 | Regulation 2(w), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
| 113 | Emergency alerts: interpretation of time periods | Yes | 20 August 2025 | Regulation 2(q), The Data (Use and Access) Act 2025
(Commencement No. 1) Regulations 2025 |
|
| 114 | Use of electronic mail for direct marketing by charities | Yes | 5 February 2026 | Regulation 2(x), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
| 115 | Commissioner’s enforcement powers | Yes | 5 February 2026 | Regulation 2(y), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
| 116 | Codes of conduct | Yes | 5 February 2026 | Regulation 2(z), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
| Part 6 The Information Commission | |||||
| 117 | (except (4)(a)) | The Information Commission | Yes | 20 August 2025 | Regulation 2(r), The Data (Use and Access) Act 2025
(Commencement No. 1) Regulations 2025 |
| 117 | (4)(a) | Not yet in force | |||
| 118 | Abolition of the office of Information Commissioner
|
Not yet in force | |||
| 119 | Transfer of functions to the Information Commission
|
Not yet in force |
|
||
| 120 | Transfer of property etc. to the Information Commission | Yes | 5 February 2026 | Regulation 2(z1), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
| Schedule 4 Lawfulness of processing: recognised legitimate interests | |||||
| Yes | 5 February 2026 | Regulation 2(z6), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|||
| Schedule 5 Purpose limitation: processing to be treated as compatible with original purpose | |||||
| Yes | 5 February 2026 | Regulation 2(z7), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|||
| Schedule 6 Automated decision-making: minor and consequential amendments | |||||
| Yes * | 5 February 2026 | Regulation 2(z8), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|||
| Schedule 7 Transfers of personal data to third countries etc.: general processing | |||||
| Yes | 5 February 2026 | Regulation 2(z9), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|||
| Schedule 8 Transfers of personal data to third countries etc.: law enforcement processing | |||||
| Yes | 5 February 2026 | Regulation 2(z10), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|||
| Schedule 9 Transfers of personal data to third countries etc.: minor and consequential amendments and Transitional provision | |||||
| Yes | 5 February 2026 | Regulation 2(z11), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|||
| Schedule 10 Complaints: minor and consequential amendments | |||||
| No * | 19 June 2026 | Regulation 3(b), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|||
| Schedule 11 Further minor provision about data protection | |||||
| Schedule 11 | (except 22, 23,
25, 28, 29, 30, 31 and 32) |
Yes | 20 August 2025 | Regulation 2(y), The Data (Use and Access) Act 2025
(Commencement No. 1) Regulations 2025 |
|
| Schedule 11 | 22 | Yes | 5 February 2026 | Regulation 2(z12), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|
| 23 | Yes | 5 February 2026 | Regulation 2(z12), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
||
| 25 | Yes | 5 February 2026 | Regulation 2(z12), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
||
| 28 | Yes | 5 February 2026 | Regulation 2(z12), The Data (Use and Access)
Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
||
| 29 | Yes | 5 February 2026 | Regulation 2(z12), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
||
| 30 | Yes | 5 February 2026 | Regulation 2(z12), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
||
| 31 | Yes | 5 February 2026 | Regulation 2(z12), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
||
| 32 | Not yet in force | ||||
| Schedule 12 Storing Information in the terminal equipment of a subscriber or user | |||||
| Yes | 5 February 2026 | Regulation 2(z13), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|||
| Schedule 13 Privacy and electronic communications: Commissioner’s enforcement powers | |||||
| Yes * | 5 February 2026 | Regulation 2(z14), The Data (Use and Access) Act 2025
(Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 |
|||
| Schedule 14 The Information Commission | |||||
| Yes | 20 August 2025 | Regulation 2(z), The Data (Use and Access) Act 2025
(Commencement No. 1) Regulations 2025 |
|||
| All provisions of the Act (including provision modifying other legislation) so far as they confer power to make Regulations or are otherwise necessary for enabling the exercise of such a power on or after the day on which this Act is passed | |||||
| Yes | 19 June 2025 | Section 142(2)(h) Data
(Use and Access) Act 2025 |
|||
Provisions marked * are subject to savings and/or Transitional provisions.