normdiff

Data (Use and Access) Act 2025 amends UK GDPR on data portability and access rights

Original title: Data (Use and Access) Act 2025 effect on Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)

The Data (Use and Access) Act 2025 introduces amendments to the UK GDPR (Regulation (EU) 2016/679 as retained in UK law) effective from the legislation's commencement date. These changes modify provisions related to data portability, the exercise of data subject rights, and access to personal data by individuals and organizations. Organizations processing personal data under UK GDPR must review and adjust their procedures to comply with the new requirements regarding how data subjects can exercise their rights and how data portability obligations are fulfilled.

What changed

  • The Data (Use and Access) Act 2025 has been enacted and commenced, creating amendments to the retained UK GDPR (Regulation (EU) 2016/679). The specific amendments to the GDPR text are reflected in modifications made to the legislation effective from 23 March 2026.
  • Data portability and subject access right procedures may be affected by new provisions introduced through the Act, though the exact nature of these amendments requires review of the full legislative text and commencement orders.
  • The Act introduces new data use and access framework provisions that interact with existing GDPR rights and obligations, potentially affecting how organizations implement data subject request processes.

Who is affected

All organizations processing personal data in the United Kingdom under UK GDPR requirements, including controllers and processors handling personal data of UK residents. The amendments particularly affect organizations managing data portability requests and subject access requests.

Summary generated by a language model; the official text prevails. Not legal advice.

More changes in GDPR