The Data (Use and Access) Act 2025 (Commencement No. 3 and Transitional and Saving Provisions) Regulations 2025

Made: 4th September 2025

The Secretary of State makes these Regulations in exercise of the powers conferred by sections 142(1) and 143(1) of the Data (Use and Access) Act 2025[^f00001].

Citation and interpretation

1

• (1) These Regulations may be cited as the Data (Use and Access) Act 2025 (Commencement No. 3 and Transitional and Saving Provisions) Regulations 2025.

• (2) In these Regulations—

• “the 2018 Act” means the Data Protection Act 2018[^f00002];

• “the 2025 Act” means the Data (Use and Access) Act 2025;

• “the Commissioner” has the same meaning as in section 3(8) of the 2018 Act;

• “controller” has the same meaning as in section 3(6) of the 2018 Act;

• “data subject” has the same meaning as in section 3(5) of the 2018 Act;

• “the relevant time” means the time when sections 79 and 88 of the 2025 Act come into force.

Commencement

2

• (1) The following provisions of the 2025 Act come into force on the day after the day on which these Regulations are made—

• (a) section 79 (legal professional privilege exemption);

• (b) section 88 (national security exemption).

• (2) The following provisions of the 2025 Act, so far as not already in force, come into force on 17th November 2025—

• (a) section 89 (joint processing by intelligence services and competent authorities);

• (b) section 90 (joint processing: consequential amendments).

Transitional and saving provision relating to data subjects’ rights to information: legal professional privilege exemption

3

Section 79 of the 2025 Act does not affect the application of Chapter 3 (rights of the data subject) of Part 3 (law enforcement processing) of the 2018 Act in a case in which a controller received a request under a section of that Chapter before the relevant time.

Transitional and saving provisions relating to the national security exemption

4

• (1) Section 88 of the 2025 Act does not affect the application of—

• (a) Chapter 3 of Part 3 of the 2018 Act, in a case in which a controller received a request under a section of that Chapter before the relevant time;

• (b) section 51 (exercise of rights through the Commissioner) of the 2018 Act, in a case in which the Commissioner received a request under that section before the relevant time;

• (c) sections 67 and 68 (obligations relating to personal data breaches) of the 2018 Act, in a case in which a personal data breach (within the meaning given by section 33(2) of the 2018 Act) occurred before the relevant time[^f00003];

• (d) section 119 (inspection of personal data) of the 2018 Act, in a case in which a controller received written notice under that section before the relevant time;

• (e) Schedule 13 (other general functions of the Commissioner) to the 2018 Act, in a case in which the Commissioner[^f00004]—

• (i) commenced enforcement action pursuant to paragraph 1(1)(a) of that Schedule, before the relevant time; or

• (ii) received information under paragraph 1(1)(g) of that Schedule, before the relevant time;

• (f) sections 142 to 154 (enforcement) of, and Schedule 15 (powers of entry and inspection) to, the 2018 Act, in relation to any of the following which is received by a controller before the relevant time[^f00005]—

• (i) an information notice;

• (ii) an assessment notice;

• (iii) an enforcement notice;

• (g) section 173 (alteration of personal data to prevent disclosure) of the 2018 Act, in a case in which a controller received a request pursuant to that section before the relevant time[^f00006];

• (h) section 187 (representation of data subjects) of the 2018 Act, in a case in which, before the relevant time, a body or other organisation authorised to act on behalf of a data subject in accordance with that section[^f00007]—

• (i) made a complaint to the Commissioner under section 165 (complaints by data subjects)[^f00008];

• (ii) made an application to the Tribunal under section 166 (orders to progress complaints)[^f00009];

• (iii) made an application to the court under section 167 (compliance orders)[^f00010]; or

• (iv) brought judicial review proceedings.

• (2) Section 88 of the 2025 Act does not affect the application of section 79(2) to (13) of the 2018 Act to a certificate issued under section 79(1) before the relevant time.

Signed

Hanson — Minister of State — Home Office — 4th September 2025

Explanatory note

(This note is not part of the Regulations)

Explanatory Note

These are the third commencement Regulations made under the Data (Use and Access) Act 2025 (c. 18) (“the 2025 Act”).

Regulation 2 brings into force sections 79, 88, 89 and 90 of the 2025 Act, which amend the Data Protection Act 2018 (c. 12) (“the 2018 Act”). Sections 79 (legal professional privilege exemption) and 88 (national security exemption) come into force on the day after the day on which these Regulations are made. Sections 89 (joint processing by intelligence services and competent authorities) and 90 (joint processing: consequential amendments) come into force on 17th November 2025.

Regulation 3 makes transitional and saving provision. The new legal professional privilege exemption does not apply where someone made a request to a data controller in accordance with the 2018 Act before section 79 of the 2025 Act came into force.

Regulation 4 makes transitional and saving provision. The national security exemptions in Part 3 of the 2018 Act - before they were changed by the 2025 Act - still apply in certain cases. These include situations where a person made a request to a data controller before section 88 of the 2025 Act came into force. It also covers cases where the controller had a duty or obligation before section 88 came into force.

An impact assessment has not been prepared for this instrument as a full impact assessment was published in relation to the provisions in the Data (Use and Access) Bill. Copies can be obtained from the UK Government website at https://www.gov.uk/government/publications/data-use-and-access-bill-supporting-documents or from the Department for Science, Innovation and Technology at 22-26 Whitehall, London, SW1A 2EG, United Kingdom.

Footnotes

[^f00001]: 2025 c. 18.

[^f00002]: 2018 c. 12.

[^f00003]: Section 67 was amended by S.I. 2019/419.

[^f00004]: Schedule 13 was amended by S.I. 2019/419.

[^f00005]: Sections 142 and 143 were amended by the Data (Use and Access) Act 2025, section 97 and S.I. 2019/419. Sections 145 and 148 were amended by the Data (Use and Access) Act 2025, section 97.

[^f00006]: Section 173 was amended by S.I. 2019/419.

[^f00007]: Section 187 was amended by S.I. 2019/419.

[^f00008]: Section 165 was amended by S.I. 2019/419.

[^f00009]: Section 166 was amended by S.I. 2019/419.

[^f00010]: Section 167 was amended by S.I. 2019/419.