The Department for Science, Innovation and Technology has announced how it intends to implement the Data (Use and Access) Act 2025. 

As we have previously commented upon, the Act represents a significant update to certain aspects of data protection law. We discuss some of the main provisions of the Act here, and recently published a list of five take aways on the Act’s impact on the UK’s data protection and e-privacy framework here. 

According to the announcement, the implementation of the Act’s provisions will take place in four stages and the commencement of various measures will occur as follows:

Stage One 

• Technical provisions which clarify aspects of the legal framework. 
• Measures requiring the Government to publish an impact assessment, a report, and a progress update on AI and copyright issues. 

Stage Two (three to four months after Royal Assent) 

• Most measures on digital verification services in Part 2. 
• Measures on the retention of information by providers of internet services in connection with the death of a child in Part 7. 

Stage Three (six months or so after Royal Assent) 

• Main changes to data protection legislation in Part 5. 
• Provisions on information standards for health and adult social care in England in Part 7. 

Stage Four (more than six months after Royal Assent) 

• Provisions that require a longer lead-time including: 

• • measures on the National Underground Register in Part 3 

• • the electronic system of registering births and deaths in Part 4. 

• Changes to the Information Commissioner’s Office (ICO) governance structures in Part 6 (expected in early 2026, once members of the ICO’s new board have been appointed). 

To read more, click here.