Data (Use and Access) Act 2025 — ICO Hub Page
The ICO's central hub for DUAA guidance, covering what the Act means for organisations, law enforcement, and the public, with links to all published and forthcoming guidance.
Data (Use and Access) Act 2025 | ICO
Skip to main content
Data (Use and Access) Act 2025
The first DUAA provisions came into force on 19 and 20 August 2025. The next set of DUAA provisions came into force on 05 February. The last set of DUAA provisions are expected to be commenced approximately 12 months after Royal Assent. The Department for Science and Innovation (DSIT) has set out the commencement plans you can find more details on the website
Data Use and Access Act 2025: plans for commencement
.
On 19 June 2025 the Data (Use and Access) Act (DUAA) became law in the UK.
For organisations
What does it mean for organisations?
An overview of what the DUAA means for organisations.
What does it mean for law enforcement agencies?
An overview of what the DUAA means for law enforcement agencies.
Summary of changes to data protection law
A summary of the changes to data protection law that affect organisations, for data protection experts.
Our plans for new and updated guidance
Information about all the guidance that we’re working on.
How we will regulate as the DUAA commences?
An overview to reassure businesses on how the law changes will impact our regulatory action.
Guidance for organisations on the new data protection complaints procedure provision
This guidance explains what organisations need to do to meet the new requirements for them to have a data protection complaints process.
For the public
How does this affect me?
Information for the public on how the changes will affect you.
Factsheets
Back to top