Explanatory note

These are the third commencement Regulations made under the Data (Use and Access) Act 2025 (c. 18) (“the 2025 Act”).

Regulation 2 brings into force sections 79, 88, 89 and 90 of the 2025 Act, which amend the Data Protection Act 2018 (c. 12) (“the 2018 Act”). Sections 79 (legal professional privilege exemption) and 88 (national security exemption) come into force on the day after the day on which these Regulations are made. Sections 89 (joint processing by intelligence services and competent authorities) and 90 (joint processing: consequential amendments) come into force on 17th November 2025.

Regulation 3 makes transitional and saving provision. The new legal professional privilege exemption does not apply where someone made a request to a data controller in accordance with the 2018 Act before section 79 of the 2025 Act came into force.

Regulation 4 makes transitional and saving provision. The national security exemptions in Part 3 of the 2018 Act - before they were changed by the 2025 Act - still apply in certain cases. These include situations where a person made a request to a data controller before section 88 of the 2025 Act came into force. It also covers cases where the controller had a duty or obligation before section 88 came into force.

An impact assessment has not been prepared for this instrument as a full impact assessment was published in relation to the provisions in the Data (Use and Access) Bill. Copies can be obtained from the UK Government website at https://www.gov.uk/government/publications/data-use-and-access-bill-supporting-documents or from the Department for Science, Innovation and Technology at 22-26 Whitehall, London, SW1A 2EG, United Kingdom.