Data (Use and Access) Act 2025 ("DUAA") Implementation Tracker
The Data (Use and Access) Act 2025 (the "DUAA") became law on 19 June 2025, bringing important reforms to the UK's data protection regime, including changes to the powers and composition of the regulator. The DUAA also introduces measures relating to smart data and data-enabled infrastructure initiatives, including a new statutory scheme for digital identity verification services and the Electronic Register of Births and Deaths.
Implementation of the DUAA is taking place in phases. Certain provisions, such as the requirement for “reasonable and proportionate” searches, when responding to data subject access requests, came into force immediately on 19 June 2025. Other measures, which depend on the development of suitable technology, are being given a longer lead-in period. We expect substantive data protection changes to be phased in early in 2026 via secondary legislation.
To stay up to date with the latest developments under the DUAA, and to follow the ICO’s progress in updating its guidance to reflect these changes, please visit our DUAA implementation tracker.
