The Data (Use and Access) Act 2025 (c. 18) (DUAA) is an act of the Parliament of the United Kingdom concerned with data protection. The act makes changes to the operation of the UK's General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.[1] The act passed into law on 19 June 2025.[2]
Quick facts Long title, Citation ...
Data (Use and Access) Act 2025|
 |
| Long title | An Act to make provision about access to customer data and business data; to make provision about services consisting of the use of information to ascertain and verify facts about individuals; to make provision about the recording and sharing, and keeping of registers, of information relating to apparatus in streets; to make provision about the keeping and maintenance of registers of births and deaths; to make provision for the regulation of the processing of information relating to identified or identifiable living individuals; to make provision about privacy and electronic communications; to establish the Information Commission; to make provision about information standards for health and social care; to make provision about the grant of smart meter communication licences; to make provision about the disclosure of information to improve public service delivery; to make provision about the retention of information by providers of internet services in connection with investigations into child deaths; to make provision about providing information for purposes related to the carrying out of independent research into online safety matters; to make provision about the retention of biometric data; to make provision about services for the provision of electronic signatures, electronic seals and other trust services; to make provision about works protected by copyright and the development of artificial intelligence systems; to make provision about the creation of purported intimate images; and for connected purposes. |
|---|
| Citation | 2025 c. 18 |
|---|
|
| Royal assent | 19 June 2025 |
|---|
| Commencement | 20 August 2025 |
|---|
|
| Amends | |
|---|
|
|
|
Close
The provisions of the act are being implemented "slowly", in stages:[3] the initial implementation of certain aspects of the new law took effect on 19 and 20 August 2025.[2]
The Information Commissioner's Office (ICO) is responsible for publishing regulatory guidance on the act.[1]
