United Kingdom: Data (Use and Access) Bill, including provisions on overriding and data breach notification entered into force

On 20 August 2025, the Data (Use and Access) Bill, including provisions on overriding and data breach notification entered into force. The Bill applies to all data controllers, processors, and electronic communications service providers handling personal data. The Bill introduces new sections to the Data Protection Act 2018 to prevent relevant enactments passed after the Bill's commencement from overriding main data protection legislation requirements. The Bill amends section 186 to strengthen protection of data subjects' rights against conflicting legislation. It establishes that data subject rights cannot be overridden unless express contrary provision is made. The Bill also mandates personal data breach notifications to the Commissioner within 72 hours of becoming aware of the breach.