Data (Use and Access) Act 2025

In short

The Data (Use and Access) Act 2025 is a UK law that updates data protection rules, loosens limits on automated decisions, turns the ICO into a board-led Information Commission and requires government reports on copyright and AI.

Also called: DUA Act, DUAA, Data Use and Access Act, Data (Use and Access) Act
Topic: Law, policy and the UK
Level: Beginner
First described: Passed by the UK Parliament and given Royal Assent on 19 June 2025 as 2025 chapter 18¹.

The Act received Royal Assent on 19 June 2025. It covers a wide spread of topics: customer and business data sharing, digital identity checks, the regulation of personal data, the creation of the Information Commission, and works protected by copyright and the development of AI systems¹.

For everyday data protection, the government lists the main changes as a more permissive framework for decisions made solely by automated processing, a new lawful ground called recognised legitimate interests, some cookies allowed without consent in low-risk cases, and a clarification that scientific research can be commercial². It also enables "Smart Data" schemes modelled on Open Banking².

It amends the UK GDPR rather than replacing it. Its section 80, for example, swaps the old Article 22 on automated decisions for new Articles 22A to 22D³.

It came into force in stages. The first provisions started on 20 August 2025, and most of the data protection changes on 5 February 2026⁴³. The ICO says all of the Act's data protection provisions were in force by June 2026⁵. On 30 September 2026 the office of Information Commissioner was abolished and its functions passed to the new Information Commission⁶.

The Act did not settle the row over AI training on copyrighted work. Instead, sections 135 to 137 required an economic impact assessment and a report within nine months⁷. The government published them on 18 March 2026, saying a broad copyright exception with an opt-out was "no longer the government's preferred way forward"⁸.

Example

An online lender can now turn down a loan application using software alone, as long as it tells the applicant, lets them give their views, offers a human review and lets them challenge the result³.

Why it matters

It sets the current rules for how UK organisations, including AI companies, can use your personal data. It also kept the AI copyright question open for future law.

Questions people ask

Is the Data (Use and Access) Act in force?

Mostly. Provisions were switched on in stages from 20 August 2025, the main data protection changes on 5 February 2026, and the Information Commission replaced the Information Commissioner on 30 September 2026⁴⁶. Some parts, such as electronic birth and death registration, had no confirmed start date on the government's commencement page⁴.

Does the Data (Use and Access) Act replace the UK GDPR?

No. It amends the UK GDPR and the Data Protection Act 2018. For example, it rewrites the rules on automated decision-making as new Articles 22A to 22D of the UK GDPR³.

Did the Data (Use and Access) Act change copyright law for AI?

No. It required the government to publish an economic impact assessment and a report on copyright and AI⁷. Those came out on 18 March 2026 and did not commit to new legislation⁸.

Related terms

Sources

Back to the glossary