Explanatory note

These are the sixth commencement regulations made under the Data (Use and Access) Act 2025 (c. 18) (“the 2025 Act”).

Regulation 2 brings into force specified provisions of the 2025 Act on 5th February 2026.

Regulation 3 brings into force section 103 of, and Schedule 10 to, the 2025 Act on 19th June 2026.

Regulation 4 makes savings provisions in respect of time limits for responses to data subjects’ requests under the UK GDPR and the Data Protection Act 2018 (c. 12) (“the 2018 Act”). Where a controller received a request before section 76 of the 2025 Act comes into force, the time limits previously in force continue to apply.

Regulation 5 provides that the changes to the UK GDPR and the 2018 Act made by section 80 of the 2025 Act apply only to decisions taken on or after section 80 comes into force.

Regulation 6 provides that the changes made to the penalty notice provisions in the 2018 Act made by section 101 of the 2025 Act do not apply where the Information Commissioner has already issued a notice of intent before that section comes into force. In such cases, the previous penalty provisions continue to apply.

Regulation 7 makes transitional provisions for complaints by data subjects to controllers. The new duties on controllers to handle complaints from data subjects at section 164(A)(3) and (4) of the 2018 Act as inserted by section 103 of the 2025 Act apply only to complaints submitted to the controller on or after section 103 comes into force. Complaints made before that date continue to be handled under the previous arrangements.

Regulations 8 to 11 make transitional and saving provision in connection with the coming into force of section 115 of the 2025 Act, which amends the enforcement regime under the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426) (“the PEC Regulations”).

Regulation 8 provides that the Information Commissioner can exercise investigatory powers applied to the PEC Regulations by regulation 31 (as substituted by section 115(5) of the 2025 Act) in relation to conduct that took place before 5th February 2026 but clarifies that enforcement sanctions are determined by regulation 11.

Regulations 9 and 10 preserve the effect of the PEC Regulations for the purpose of completing the exercise of investigatory powers and audits begun before commencement.

The provisions governing the completion of such audits continue to apply where an audit was begun (and not cancelled) before that date.

Regulation 11 determines the applicable enforcement regime by requiring enforcement action (including the imposition of sanctions) to be taken under the PEC Regulations as they had effect immediately before commencement where the relevant conduct occurred before that date, and under the PEC Regulations as amended where the conduct occurred on or after commencement.

Regulation 12 makes amendments to the 2018 Act to update specified commencement references.

An impact assessment has not been prepared for this instrument as a full impact assessment was published in relation to the provisions in the Data (Use and Access) Bill. Copies can be obtained from the UK Government website at https://www.gov.uk/government/publications/data-use-and-access-bill-supporting-documents or from the Department for Science, Innovation and Technology at 22-26 Whitehall, London, SW1A 2EG, United Kingdom.