Dear members, the next commencement date of the The Data (Use and Access) Act 2025 are due and cover a number of uses of data that will impact the sector including consent to processing for purposes of scientific research.
| These are the sixth commencement regulations made under the Data (Use and Access) Act 2025 (c. 18) (“the 2025 Act”). |
Provisions of the 2025 Act coming into force on 5th February 2026
- The following provisions of the 2025 Act, so far as not already in force(1), come into force on 5th February 2026—
(a)section 67 (meaning of research and statistical purposes);
(b)section 68 (consent to processing for the purposes of scientific research);
(c)section 70 (lawfulness of processing);
(d)section 71 (the purpose limitation);
(e)section 72 (processing in reliance on relevant international law);
(f)section 73 (elected representatives responding to requests);
(g)section 75 (fees and reasons for responses to data subjects’ requests about law enforcement processing);
(h)section 76 (time limits for responding to data subjects’ requests);
(i)section 77 (information to be provided to data subjects);
(j)section 80 (automated decision-making);
(k)section 81 (data protection by design: children’s higher protection matters);
(l)section 83 (general processing and codes of conduct);
(m)section 85 (transfers of personal data to third countries and international organisations);
(n)section 86 (safeguards for processing for research etc purposes);
(o)section 87 (section 86: consequential provision);
(p)section 94 (manifestly unfounded or excessive requests to the Commissioner);
(q)section 98 (power of the Commissioner to require a report);
(r)section 99 (assessment notices: removal of OFSTED restriction);
(s)section 100 (interview notices);
(t)section 101 (penalty notices);
(u)section 105 (consequential amendments to the EITSET Regulations);
(v)section 110 (interpretation of the PEC Regulations);
(w)section 112 (storing information in the terminal equipment of a subscriber or user);
(x)section 114 (use of electronic mail for direct marketing by charities);
(y)section 115 (Commissioner’s enforcement powers);
(z)section 116 (codes of conduct);
(z1)section 120 (transfer of property etc to the Information Commission);
(z2)section 121 (information standards for health and adult social care in England);
(z3)section 130 (recognition of EU conformity assessment bodies);
(z4)section 132 (recognition of overseas trust products);
(z5)subsection (4) of section 133 (co-operation between supervisory authority and overseas authorities);
(z6)Schedule 4 (lawfulness of processing: recognised legitimate interests);
(z7)Schedule 5 (purpose limitation: processing to be treated as compatible with original purpose);
(z8)Schedule 6 (automated decision-making: minor and consequential amendments);
(z9)Schedule 7 (transfers of personal data to third countries etc: general processing);
(z10)Schedule 8 (transfers of personal data to third countries etc: law enforcement processing);
(z11)Schedule 9 (transfers of personal data to third countries etc: minor and consequential amendments and transitional provision);
(z12)Schedule 11 (further minor provision about data protection), except paragraph 32;
(z13)Schedule 12 (storing information in the terminal equipment of a subscriber or user);
(z14)Schedule 13 (privacy and electronic communications: Commissioner’s enforcement powers);
(z15)Schedule 15 (information standards for health and adult social care in England).
Provisions of the 2025 Act coming into force on 19th June 2026
- The following provisions of the 2025 Act, so far as not already in force(1), come into force on 19th June 2026—
(a)section 103 (complaints by data subjects);
(b)Schedule 10 (complaints: minor and consequential amendments).
