The Data (Use and Access) Act 2025 is the United Kingdom statute that amends the country's post-Brexit data protection regime. It changes the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), the rules that govern cookies and electronic marketing. It also creates legal frameworks for sharing customer data and for digital identity checks. The Act, cited as 2025 c. 18, received Royal Assent on June 19, 2025, and as of November 2026 almost all of its data protection provisions are in force.

What the Act contains

The Act runs to 144 sections across eight parts. Part 1 covers smart data, giving ministers power to make businesses share data in standard formats; the Fuel Finder price scheme, made on December 17, 2025, was an early use. Part 2 sets up a trust framework for digital verification services. Parts 3 and 4 deal with an underground asset register and registers of births and deaths. Part 5, on data protection and privacy, matters most to advertisers. Part 6 restructures the regulator, and Part 7 includes copyright and artificial intelligence (AI) reporting duties.

Cookies and PECR

For marketers the most practical change sits in the cookie rules. Regulation 6 of PECR has long required consent before storing or reading information on a user's device, with exemptions only for transmission and services "strictly necessary" to provide what the user asked for. The Act inserted a new Schedule A1 into PECR, in force from February 5, 2026, which adds exceptions for statistical purposes, website appearance and emergency assistance. Advisers count the additions differently, some describing three new exceptions and others five.

The statistical exception allows cookies or similar technologies without consent where the sole purpose is to collect statistics about how a service is used "with a view to making improvements", according to the Information Commissioner's Office (ICO) guidance summarised by Hunton. The ICO describes it as "essentially for analytics purposes". Users must still be given a "simple and free" way to object, so the exception works as an opt-out rather than a free pass. The appearance exception covers adapting how a site looks or works to a user's stated preference, but not content selected from known or inferred interests.

The ICO published its final storage and access technologies guidance in late April 2026. Hunton dates it April 29, 2026, while Trethowans gives April 28.

Advertising cookies remain inside the consent requirement. The Act did, however, add a regulation 6A power letting the government create further exceptions through secondary legislation after consulting the regulator. On May 18, 2026, the ICO published advice to government proposing that some low-risk advertising activity could proceed without consent: contextual targeting on a broad taxonomy, city or region level geolocation, first-party frequency capping, aggregated measurement and pre-bid invalid traffic filtering. Behavioural targeting and cross-site attribution would still need consent. According to Lewis Silkin, "nothing has changed yet": no regulation 6A instrument had been laid as of November 2026.

Fines

The Act aligned PECR penalties with the UK GDPR. The old PECR ceiling was a fixed 500,000 pounds. From February 5, 2026, the maximum is 17.5 million pounds or 4 per cent of global annual turnover, whichever is higher, a 35-fold rise in the fixed cap.

UK GDPR fines were not raised. They already carried the same 17.5 million pound or 4 per cent ceiling, the figure cited when the ICO fined Imgur owner MediaLab 247,590 pounds over children's data in February 2026.

Lawful bases and recognised legitimate interests

The Act added a seventh lawful basis to Article 6 of the UK GDPR: recognised legitimate interests. Under ordinary legitimate interest, a controller must balance its interests against the rights of the individual and usually documents this in a legitimate interests assessment. The recognised version removes the balancing test for a closed list of purposes set out in a new annex, including crime prevention, safeguarding vulnerable people, responding to emergencies, national security and disclosures to public bodies. Necessity still has to be shown.

The Act also lists examples of ordinary legitimate interests, among them direct marketing, intra-group transfers and network security. These still need the balancing test: direct marketing is not on the recognised list.

Automated decision-making

Section 80 replaced Article 22 of the UK GDPR with new Articles 22A to 22D, in force from February 5, 2026. The old article was, in effect, a prohibition on solely automated decisions with legal or similarly significant effects, subject to three exceptions: contract, law or explicit consent. The new framework generally permits such decisions, except where special category data such as health or ethnicity is involved. Controllers must apply safeguards under Article 22C: tell people about significant decisions, let them make representations, provide human intervention and allow decisions to be contested. A Bird & Bird briefing quoted the ICO as saying the amendments "reframe the ADM provisions from a prohibition with exceptions to a right of challenge with safeguards". Automated decision-making in the EU still starts from the stricter default.

Subject access, research and transfers

The right of access now includes a "stop the clock" rule: the one-month response period pauses while a controller waits for a requester to clarify a request. Searches need only be "reasonable and proportionate", codifying case law. Scientific research expressly includes commercial research, and broad consent to areas of research is allowed. For international transfers, both the government's adequacy test and the exporter's test now ask whether protection abroad is "not materially lower" than in the UK.

A complaints duty arrived last. From June 19, 2026, controllers must run a complaints procedure, acknowledge complaints within 30 days and tell complainants of their right to go to the regulator, according to Mayer Brown.

The Information Commission

Under the Data Protection Act 2018, the Information Commissioner was a corporation sole, legally one person. Sections 117 to 119 abolish the office of Information Commissioner and transfer its functions to the Information Commission, a body corporate run by a board. The transfer took effect on September 30, 2026, under Commencement No. 9 regulations (SI 2026/1015), with seven non-executive members joining the board, according to CMS. The regulator kept its powers and still calls itself the ICO in public.

Origin and passage

The Act is the second attempt at the reform. The Conservative government's Data Protection and Digital Information Bill, introduced by Michelle Donelan on March 8, 2023, was at Lords report stage when Parliament was prorogued on May 24, 2024, ahead of the general election, and it fell. The Labour government introduced a narrower Data (Use and Access) Bill in the House of Lords on October 23, 2024, sponsored by the Department for Science, Innovation and Technology (DSIT) under Peter Kyle.

The bill's slowest stretch was a dispute over AI and copyright. At Lords report stage in January 2025, peers defeated the government on amendments covering "copyright, web crawlers and AI", according to the House of Commons Library. After repeated exchanges between the Houses, the compromise was sections 135 to 137, which require an economic impact assessment and a report on copyright in AI development. The report met its March 18, 2026 deadline and, according to Reed Smith, formally abandoned the government's earlier preferred text and data mining opt-out without endorsing a replacement.

Commencement then ran in stages, from August 20, 2025 to the main data protection tranche (Commencement No. 6, SI 2026/82) on February 5, 2026.

Why it matters for marketers

The Act is the first significant divergence between UK and EU data law since Brexit. First-party analytics now has an opt-out route in the UK that most of the EU lacks, a statutory mechanism exists to widen consent-free advertising, and the fine ceiling makes cookie enforcement financially serious. The European Commission nonetheless renewed the UK's adequacy decisions on December 19, 2025, adding a six-year sunset to December 27, 2031, so data flows from the EU continue.

Criticisms and open disputes

Civil society groups argue the Act shifts burdens onto individuals. Privacy International, in evidence published on September 25, 2026, said automated decisions are now "generally presumed compliant" unless a person shows safeguards were not followed, and cited a DSIT impact assessment acknowledging that people with protected characteristics "are more likely to face discrimination from ADM". The Open Rights Group has opposed any loosening of consent for advertising, arguing that targeting on personal data "is the main enabler of harms". Publishers take the opposite view: the Professional Publishers Association told the ICO its members "cannot effectively monetise consent-less data inventory".

UK GDPR and the Data Protection Act 2018. These remain the core UK law. The Act amends them rather than replacing them.

Data Protection and Digital Information Bill. The failed 2023 predecessor, which never became law.

EU Data Act. Regulation (EU) 2023/2854, applicable from September 12, 2025, governs data from connected products. It has no legal link to the UK Act.

Digital Omnibus. The European Commission's proposal to amend the GDPR and ePrivacy rules is the EU's own simplification effort, still in negotiation in late 2026.

Recent developments

The final structural step came on September 30, 2026, when the Information Commission took over. The leadership picture is unsettled: Computer Weekly reported that John Edwards, the Information Commissioner, stepped back at the end of February 2026 during a workplace investigation, with chief executive Paul Arnold taking on his non-delegable duties. The government has not yet laid regulation 6A rules on advertising cookies, the change the ad industry is watching most closely.

Timeline

  • March 8, 2023 - Data Protection and Digital Information Bill introduced in the Commons by Michelle Donelan.
  • May 24, 2024 - Parliament prorogued before the general election; the bill falls.
  • October 23, 2024 - Data (Use and Access) Bill introduced in the House of Lords.
  • January 21 and 28, 2025 - Lords report stage; government defeated on copyright, web crawlers and AI.
  • February 5, 2025 - Lords third reading.
  • June 19, 2025 - Royal Assent; the Act becomes 2025 c. 18.
  • August 20, 2025 - Commencement No. 1 takes effect.
  • December 1, 2025 - Most of Part 2 (digital verification services) in force.
  • December 17, 2025 - Motor Fuel Price (Open Data) Regulations 2025 made under Part 1.
  • December 19, 2025 - European Commission renews UK adequacy decisions to December 27, 2031.
  • February 5, 2026 - Commencement No. 6 (SI 2026/82): recognised legitimate interests, Articles 22A-22D, cookie exceptions and higher PECR fines in force.
  • March 18, 2026 - Statutory deadline for the copyright and AI report, which drops the opt-out proposal.
  • April 28 or 29, 2026 - ICO publishes final storage and access technologies guidance.
  • May 18, 2026 - ICO publishes advice on consent-free low-risk advertising.
  • June 19, 2026 - Complaints procedure duty for controllers in force.
  • September 30, 2026 - Information Commission replaces the Information Commissioner (SI 2026/1015).

Summary

Who: The UK government (DSIT) proposed the Act and commences it by regulation. The ICO, now the Information Commission, enforces it. It applies to every organisation processing personal data in the UK and every site setting cookies on UK users' devices.

What: A 2025 statute amending the UK GDPR, the Data Protection Act 2018 and PECR. It adds cookie consent exceptions for analytics and site appearance, raises PECR fines to 17.5 million pounds or 4 per cent of turnover, creates recognised legitimate interests, permits automated decisions with safeguards, and restructures the regulator.

When: Royal Assent on June 19, 2025. Most data protection provisions took effect on February 5, 2026, the complaints duty on June 19, 2026, and the Information Commission on September 30, 2026.

Where: The United Kingdom, across England, Wales, Scotland and Northern Ireland. EU law is unaffected, though the EU renewed UK adequacy after reviewing the Act.

Why: The government sought to cut compliance costs inherited from EU law and to enable data sharing schemes. Critics argue it weakens individual protections, while publishers want it to go further on advertising consent.