Data (Use and Access) Act 2025 and UK GDPR
The Data (Use and Access) Act 2025 (DUAA) amends the UK data-protection framework. UK GDPR and the Data Protection Act 2018 remain central. Apply their current amended provisions. SRC-006
The user-requested GOV.UK Data (Use and Access) Act 2025 collection is registered as SRC-077. It brings together official factsheets, commencement information and supporting documents. The collection is a research entry point; specific legal conclusions below use the relevant provisions and commencement instruments.
Scope: England, with UK-wide law. Evidence checked: 19 October 2026. Status: evidence-checked synthesis; independent legal review remains open.
Verified commencement
| Date | What the evidence establishes |
|---|---|
| 19 June 2025 | Royal Assent. This does not mean every provision took effect that day. SRC-077 |
| 5 February 2026 | SI 2026/82 brought most relevant Part 5 reforms into force, including the changes addressed below. SRC-007 |
| 19 June 2026 | SI 2026/82 brought the complaints provisions into force. SRC-007 |
| 30 September 2026 | SI 2026/1015 commenced abolition of the office of Information Commissioner and transfer of its functions to the Information Commission. SRC-008 |
These dates establish the cited provisions. They do not claim that every measure across this wide-ranging Act shares one commencement date. Earlier conduct may engage saving or transitional provisions. SRC-007, SRC-008
Changes relevant to health-data services
| Area | Current position and practical consequence |
|---|---|
| Lawful basis | Article 6(1)(ea) adds recognised legitimate interests, limited to Annex 1. This does not supply an Article 9 condition for health data. SRC-004, SRC-003 |
| Public task | Article 6(1)(e) concerns the controller's own task. A separate controller cannot simply adopt its customer's public-task basis. SRC-004 |
| Further processing | Article 8A governs purpose compatibility. Article 5(3) confirms compatibility alone does not make processing lawful. Review reuse for analytics, training or product development. SRC-001, SRC-005 |
| Research | Article 4 clarifies scientific research. Safeguards now sit in Articles 84A–D. Commercial research can qualify, but must meet the legal tests. SRC-001, SRC-009, SRC-010 |
| Automated decisions | Articles 22A–D replace Article 22. Significant solely automated decisions involving health data retain strict restrictions and safeguards. SRC-011, SRC-012, SRC-013 |
| Individual requests | Subject-access searches must be reasonable and proportionate. Justified clarification can pause the response clock. These changes do not remove access rights. SRC-001, SRC-006 |
| Complaints | Provide an accessible route, acknowledge within 30 days, investigate appropriately and communicate the outcome without undue delay. SRC-006 |
| Transfers | Revised Article 46 expressly requires the data-protection test. Protection after transfer must not be materially lower than the UK standard. SRC-022 |
| Children | Article 25 adds higher-protection considerations for qualifying online services likely to be accessed by children. Check the provision's scope before applying it. SRC-001 |
DUAA also addresses health and social care information standards. Assess those amendments through the NHS standards page; the service and standard's scope still matter. SRC-049
Consequences for an assessment
The Article 6 and Article 9 requirements remain separate. The principles, security duties and role-based responsibilities remain relevant. The reforms do not create a general permission for secondary use of health records. SRC-003, SRC-004, SRC-005, SRC-014, SRC-019
Check confidentiality independently. Check EU GDPR territorial scope where cross-border facts require it. The EU regime must not be described using UK-only amendments. SRC-078
For each real service, the recipient controller must assess the current rules for its collection, use, decisions and onward disclosures. It must not assume that the provider's disclosure authority covers those operations. Update the relevant safeguards and accountability records where necessary. The provider need not repeat these statutory duties as disclosure conditions. SRC-003, SRC-004, SRC-005, SRC-103
Use the requester assurance assessment to distinguish continuing duties from the changes above. For example, the DPIA requirement remains conditional on Article 35 and the regulator's published triggers. Revised automated-decision rules do not remove the separate DPIA trigger for opportunity decisions involving special-category data. SRC-018, SRC-100
Record which amendments affect the service's purposes, records, decisions and contracts. That factual assessment remains open in the validation queue.