The Data (Use and Access) Act 2025 amends UK GDPR to enable data access for commercial use
Original title: The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 effect on Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)
The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 modifies UK GDPR to implement the Data (Use and Access) Act framework. This introduces new mechanisms for accessing and using personal data under controlled conditions, with balancing provisions between data subjects' rights and commercial data access. Organizations handling personal data must understand the transitional provisions and any new obligations related to data access rights under the new Act.
What changed
- The regulations amend UK GDPR to incorporate provisions of the Data (Use and Access) Act 2025, which establishes a framework for accessing and using personal data for commercial purposes under specified conditions
- Consequential amendments are made to reflect the new data access and use mechanisms introduced by the 2025 Act, affecting how personal data can be accessed and processed
- Transitional provisions are established to manage the implementation period and ensure compliance with both existing GDPR requirements and the new data access framework
Who is affected
All UK organizations processing personal data, including those seeking to access data under new commercial data access mechanisms introduced by the Data (Use and Access) Act 2025; UK data controllers and processors; data subjects in the UK
Summary generated by a language model; the official text prevails. Not legal advice.