normdiff

Data (Use and Access) Act 2025 amends GDPR requirements for data subject rights and processing

Original title: The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 effect on Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)

The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 amends Regulation (EU) 2016/679 as it applies to the United Kingdom. The amendments modify specific provisions of the UK GDPR to align with the new data access and use framework introduced by the 2025 Act. Organizations subject to UK GDPR must review and update their data processing practices, legal bases, and subject rights procedures to comply with the amended requirements. Transitional provisions may apply to existing processing arrangements during the implementation period.

What changed

  • The regulations introduce consequential amendments to UK GDPR provisions stemming from the Data (Use and Access) Act 2025, affecting how organizations must handle data subject rights and processing obligations.
  • Specific amendments modify the application of data protection principles and lawful basis requirements under UK GDPR in light of new data access and use framework provisions.
  • Transitional provisions are established to manage the shift from existing GDPR requirements to amended requirements, allowing organizations time to comply with changes.
  • The amendments ensure alignment between UK GDPR and the new legislative framework introduced by the Data (Use and Access) Act 2025.

Who is affected

All organizations processing personal data in the UK subject to UK GDPR, including data controllers and processors across all sectors and sizes

Summary generated by a language model; the official text prevails. Not legal advice.

More changes in GDPR