UK Data Act 2025 Guide: What Changed for Security and Privacy Teams, Section by Section

The Data (Use and Access) Act 2025 rewrote parts of UK data protection law in stages over sixteen months, and teams that read a summary at Royal Assent are now working from an incomplete picture. The Act (2025 c. 18) amends the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), puts digital verification services on a statutory footing, creates powers for smart data schemes, and replaces the Information Commissioner's Office with the Information Commission. This guide goes section by section through the changes that land on security, privacy and identity teams, lists which commencement regulations brought each part into force, and turns them into concrete control changes. It is for DPOs, privacy engineers, security architects and identity teams at UK organisations and at overseas organisations processing UK personal data. For the underlying regime see the UK GDPR and Data Protection Act 2018 Guide; this page covers what the 2025 Act changed.

Status checked 27 October 2026: the ICO's guidance states that all data protection provisions of the Act were in force by 19 June 2026. Most of Part 5 commenced on 5 February 2026 (SI 2026/82), most of Part 2 on digital verification services on 1 December 2025 (SI 2025/1213), and the office of Information Commissioner was abolished and its functions transferred to the Information Commission under SI 2026/1015 on 30 September 2026. Parts 3 and 4 (the National Underground Asset Register and electronic registers of births and deaths) still had no confirmed commencement date on the government's commencement page, last updated 12 October 2026.

Key takeaways

• PECR enforcement now runs on DPA 2018 machinery: Schedule 13 replaces Schedule 1 to PECR and applies the DPA 2018 information, assessment, interview, enforcement and penalty provisions to cookies, marketing and telecoms rules, including officer liability for some marketing breaches.
• Automated decisions are permitted with safeguards: new UK GDPR Articles 22A to 22D allow significant solely automated decisions on most lawful bases, but require information, representations, human intervention and a route to contest, with tighter limits for special category data.
• Some security processing gets an easier lawful basis: Schedule 4 creates recognised legitimate interests, including crime prevention and detection and public security, that need no balancing test.
• New duties sit with operations teams: a complaints process with acknowledgement within 30 days, a 72-hour benchmark for PECR breach notification, and children's higher protection matters in design.
• The regulator is stronger: the Information Commission can issue interview notices and require reports from approved persons, on top of existing information and assessment notices.

Scope: who and what is covered

Territorial scope of the UK GDPR is unchanged: it still reaches overseas controllers that target or monitor people in the UK. The Act does not replace the UK GDPR; it amends it, so the core principles, security duty in Article 32 and 72-hour breach reporting in Article 33 still apply.

Key obligations

Changes to the UK GDPR and DPA 2018 (Part 5, Chapter 1)

Automated decision-making in detail (Articles 22A to 22D)

• Solely automated (22A): a decision with no meaningful human involvement. Profiling used to reach the decision counts towards that assessment, so a reviewer who simply approves model output may not be meaningful involvement.
• Significant decision (22A): a decision with a legal effect, or a similarly significant effect, on the person.
• Restrictions (22B): a significant decision based wholly or partly on special category data cannot be solely automated unless it rests on explicit consent, or is necessary for a contract or required or authorised by law and Article 9(2)(g) applies. A solely automated significant decision cannot rely on recognised legitimate interests.
• Safeguards (22C): measures that give the person information about the decision, let them make representations, let them obtain human intervention by the controller, and let them contest the decision.
• Future detail (22D): the Secretary of State may set by regulations what is or is not meaningful human involvement and similarly significant effect, and add to the safeguards.

Changes to PECR (Part 5, Chapter 2)

• Storage and access technologies (s 112, Sch 12): consent is no longer needed for some cookies and similar technologies. ICO guidance lists five exceptions: communication, strictly necessary (which covers security of terminal equipment, fraud prevention, fault detection and authentication), statistical purposes, appearance and functionality, and emergency assistance. The statistical and appearance exceptions need clear information and a simple, free way to object. Advertising and cross-site tracking still need consent. See the Cookie and Tracking Technology Compliance Guide.
• Breach notification (s 111): communications providers must notify personal data breaches under regulation 5A without undue delay "and, where feasible, not later than 72 hours after having become aware of it", with reasons for any later notification.
• Charity soft opt-in (s 114): charities may email supporters and people who expressed interest, unless they object.
• Enforcement (s 115, Sch 13): the DPA 2018 enforcement provisions now apply to PECR, including information notices to any person, assessment and interview notices, and penalty notices under section 157 of the DPA 2018 for breaches of regulations 5, 6, 7, 8, 14, 19 to 24. Officers of a body corporate can be penalised for marketing breaches under regulations 19 to 24 that involved their consent, connivance or neglect. No penalty notice may be issued for a regulation 5A breach notification failure. See the PECR Guide.

Digital verification services (Part 2)

Part 2 gives the DVS trust framework (s 28) and a statutory register (s 32) a legal basis, with a trust mark for registered providers (s 50) and an information gateway that lets public authorities disclose information to registered providers to verify identity or attributes (s 45). Registration is voluntary, but relying parties will increasingly ask for it. See the UK Digital Verification Services Trust Framework Guide.

Timeline and current status

Secondary legislation under Article 22D and smart data regulations under Part 1 may still change the detail. Check legislation.gov.uk and the government commencement page before relying on this table.

Enforcement and penalties

• UK GDPR fines unchanged: the Act does not change the UK GDPR maximum penalties set by section 157 of the DPA 2018; its effect is to extend that penalty framework to PECR.
• PECR penalties: before the Act, PECR monetary penalties were widely reported as capped at £500,000; Schedule 13 applies the DPA 2018 penalty provisions (section 155 and a modified section 157) to regulations 5, 6, 7, 8, 14 and 19 to 24 instead, which commentators read as allowing the UK GDPR higher maximum of £17.5 million or 4% of worldwide annual turnover for serious PECR breaches. Confirm the exact cap for each regulation with counsel.
• New investigatory tools: interview notices (s 100) compel a person to attend and answer questions; section 98 lets the Commission require a report from an approved person, similar to a skilled person review in financial services.
• Procedural guidance: the ICO consulted on draft enforcement procedural guidance in late 2025; check whether the final version has been published.
• Annual report on regulatory action (s 102): the Commission must publish what action it has taken, which makes enforcement trends easier to track. See the GDPR Enforcement Decisions on Security Failures Guide.

What it means for AI agents and non-human identities

• Agent decisions can be automated decisions: an AI agent that approves, refuses or prices something for a person, with no meaningful human involvement, is making a solely automated decision. Each such agent needs an owner who can show the 22C safeguards work. See the AI Agent Authorisation Guide.
• Human review must be real: log who reviewed an agent's output, what they saw and whether they could change it; a rubber-stamp step is unlikely to count as meaningful.
• Security monitoring and recognised interests: crime prevention and detection is a recognised legitimate interest, but not every security analytics use is crime prevention. Keep monitoring of service accounts and staff activity under your existing legitimate interests assessment unless the condition clearly fits. See the Privacy in Security Logging and Monitoring Guide.
• Machine access to personal data is still processing: service accounts, API keys and agent tokens that read personal data must be in your records of processing and access controls; reasonable and proportionate subject access searches will include data that agents copied into vector stores or logs.
• Interview and report notices reach technical teams: be ready to explain how a breach happened, including which machine credential was used. See the Service Account Security Guide.

Framework mapping

Compliance steps

1. Gap-assess against the commencement table: list each change above, its section and whether your policy, notice and process reflect it. Start with PECR, because the enforcement change is the largest.
2. Re-run the cookie audit: classify every storage and access technology against the five exceptions; keep consent for advertising and tracking; add objection controls for analytics and functionality cookies. Test in a staging site first and keep the old banner configuration for rollback.
3. Inventory automated decisions: include rules engines, scoring models and AI agents. For each significant decision, record whether there is meaningful human involvement and which 22C safeguards apply.
4. Review lawful bases: decide where recognised legitimate interests apply and record the Annex 1 condition; leave other processing on its existing basis.
5. Stand up the complaints process: an electronic form, a 30-day acknowledgement target and an owner; feed complaints into the DPO's risk log.
6. Update subject access procedures: document what reasonable and proportionate searches cover, including logs, backups and agent memory stores.
7. Update incident playbooks: for communications providers, add the 72-hour PECR benchmark and the reasons-for-delay step alongside the UK GDPR Article 33 process.
8. Prepare for regulator contact: name who would attend an interview notice and how evidence would be produced; update references from ICO to Information Commission in contracts and notices at the next review.

Detection and measurement

• Cookie compliance: percentage of storage and access technologies with a documented exception or consent basis.
• Automated decision coverage: percentage of significant automated decisions with all four 22C safeguards tested.
• Complaints: percentage acknowledged within 30 days and median time to response.
• Subject access: percentage of requests answered within the time limit, and number of systems in the documented search scope.
• Machine access to personal data: percentage of service accounts and agents with access to personal data that have a named owner and a processing record.

Common failure patterns

• Treating the cookie exceptions as a blanket exemption: analytics that feed advertising or track individuals still need consent.
• Assuming automated decisions are now unrestricted: the safeguards in 22C are mandatory and the special category limits remain.
• Stretching recognised legitimate interests: applying the crime condition to general productivity or behavioural monitoring.
• Ignoring PECR risk: marketing and cookie teams still budgeting for pre-2026 fine levels.
• Leaving agents out of the inventory: AI agents making customer decisions under a service account with no owner and no review log.

Practitioner checklist

• Map each Part 5 section to an owner and a policy update.
• Re-audit cookies and similar technologies against the five ICO exceptions.
• Inventory significant automated decisions, including AI agents, and test the 22C safeguards.
• Record any reliance on recognised legitimate interests with its Annex 1 condition.
• Run a complaints process with a 30-day acknowledgement target.
• Document reasonable and proportionate subject access search scope.
• Add the PECR 72-hour benchmark to telecoms breach playbooks.
• Give every machine identity that touches personal data an owner and a processing record.
• Track Article 22D regulations and Part 1 smart data regulations.

Standards and references

• legislation.gov.uk: Data (Use and Access) Act 2025
• legislation.gov.uk: Data (Use and Access) Act 2025, section 80 Automated decision-making
• legislation.gov.uk: Data (Use and Access) Act 2025, Schedule 13 PECR enforcement powers
• GOV.UK: Data (Use and Access) Act 2025 plans for commencement
• ICO: The Data (Use and Access) Act 2025, what does it mean for organisations
• ICO: Storage and access technologies, what are the exceptions
• NIST: Cybersecurity Framework 2.0

This guide summarises the Data (Use and Access) Act 2025 and its commencement as of 27 October 2026 and is not legal advice. Related NHI Mgmt Group resources: UK GDPR and Data Protection Act 2018 Guide · PECR Guide · UK Digital Verification Services Trust Framework Guide · Privacy Programme Guide for Security Teams