<!-- Derived Markdown alternate of duaa-2025.md; canonical repository sources and registered evidence retain authority. -->


# Data (Use and Access) Act 2025 and UK GDPR

The **Data (Use and Access) Act 2025 (DUAA)** amends the UK data-protection framework. UK GDPR and the Data Protection Act 2018 remain central. Apply their current amended provisions. [SRC-006](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-006)

The user-requested **GOV.UK Data (Use and Access) Act 2025 collection** is registered as [SRC-077](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-077). It brings together official factsheets, commencement information and supporting documents. The collection is a research entry point; specific legal conclusions below use the relevant provisions and commencement instruments.

**Scope:** England, with UK-wide law. **Evidence checked:** 19 October 2026. **Status:** evidence-checked synthesis; independent legal review remains open.

## Verified commencement

| Date | What the evidence establishes |
|---|---|
| 19 June 2025 | Royal Assent. This does not mean every provision took effect that day. [SRC-077](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-077) |
| 5 February 2026 | SI 2026/82 brought most relevant Part 5 reforms into force, including the changes addressed below. [SRC-007](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-007) |
| 19 June 2026 | SI 2026/82 brought the complaints provisions into force. [SRC-007](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-007) |
| 30 September 2026 | SI 2026/1015 commenced abolition of the office of Information Commissioner and transfer of its functions to the Information Commission. [SRC-008](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-008) |

These dates establish the cited provisions. They do not claim that every measure across this wide-ranging Act shares one commencement date. Earlier conduct may engage saving or transitional provisions. [SRC-007](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-007), [SRC-008](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-008)

## Changes relevant to health-data services

| Area | Current position and practical consequence |
|---|---|
| Lawful basis | Article 6(1)(ea) adds recognised legitimate interests, limited to Annex 1. This does not supply an Article 9 condition for health data. [SRC-004](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-004), [SRC-003](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-003) |
| Public task | Article 6(1)(e) concerns the controller's own task. A separate controller cannot simply adopt its customer's public-task basis. [SRC-004](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-004) |
| Further processing | Article 8A governs purpose compatibility. Article 5(3) confirms compatibility alone does not make processing lawful. Review reuse for analytics, training or product development. [SRC-001](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-001), [SRC-005](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-005) |
| Research | Article 4 clarifies scientific research. Safeguards now sit in Articles 84A–D. Commercial research can qualify, but must meet the legal tests. [SRC-001](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-001), [SRC-009](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-009), [SRC-010](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-010) |
| Automated decisions | Articles 22A–D replace Article 22. Significant solely automated decisions involving health data retain strict restrictions and safeguards. [SRC-011](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-011), [SRC-012](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-012), [SRC-013](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-013) |
| Individual requests | Subject-access searches must be reasonable and proportionate. Justified clarification can pause the response clock. These changes do not remove access rights. [SRC-001](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-001), [SRC-006](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-006) |
| Complaints | Provide an accessible route, acknowledge within 30 days, investigate appropriately and communicate the outcome without undue delay. [SRC-006](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-006) |
| Transfers | Revised Article 46 expressly requires the data-protection test. Protection after transfer must not be materially lower than the UK standard. [SRC-022](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-022) |
| Children | Article 25 adds higher-protection considerations for qualifying online services likely to be accessed by children. Check the provision's scope before applying it. [SRC-001](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-001) |

DUAA also addresses health and social care information standards. Assess those amendments through the [NHS standards page](https://healthcare-data-management-wiki.pages.dev/nhs-standards/index.md); the service and standard's scope still matter. [SRC-049](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-049)

## Consequences for an assessment

The Article 6 and Article 9 requirements remain separate. The principles, security duties and role-based responsibilities remain relevant. The reforms do not create a general permission for secondary use of health records. [SRC-003](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-003), [SRC-004](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-004), [SRC-005](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-005), [SRC-014](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-014), [SRC-019](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-019)

Check [confidentiality](https://healthcare-data-management-wiki.pages.dev/confidentiality/index.md) independently. Check [EU GDPR territorial scope](https://healthcare-data-management-wiki.pages.dev/legal-framework/index.md#jurisdiction-boundary) where cross-border facts require it. The EU regime must not be described using UK-only amendments. [SRC-078](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-078)

For each real service, the recipient controller must assess the current rules for its collection, use, decisions and onward disclosures. It must not assume that the provider's disclosure authority covers those operations. Update the relevant safeguards and accountability records where necessary. The provider need not repeat these statutory duties as disclosure conditions. [SRC-003](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-003), [SRC-004](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-004), [SRC-005](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-005), [SRC-103](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-103)

Use the [requester assurance assessment](https://healthcare-data-management-wiki.pages.dev/requester-assurance/index.md) to distinguish continuing duties from the changes above. For example, the DPIA requirement remains conditional on Article 35 and the regulator's published triggers. Revised automated-decision rules do not remove the separate DPIA trigger for opportunity decisions involving special-category data. [SRC-018](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-018), [SRC-100](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-100)

Record which amendments affect the service's purposes, records, decisions and contracts. That factual assessment remains open in the [validation queue](https://healthcare-data-management-wiki.pages.dev/validation-queue/index.md).

## Related pages

- [Legal framework and Article 6/9 conditions](https://healthcare-data-management-wiki.pages.dev/legal-framework/index.md)
- [Data lifecycle and supplier duties](https://healthcare-data-management-wiki.pages.dev/data-lifecycle/index.md)
- [NHS standards and assurance](https://healthcare-data-management-wiki.pages.dev/nhs-standards/index.md)
- [Applicability assessment](https://healthcare-data-management-wiki.pages.dev/applicability/index.md)
- [Source register](https://healthcare-data-management-wiki.pages.dev/sources/index.md)