United Kingdom: Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 including data protection regulation enter into force

On 5 February 2026, the Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (2026 No. 82 (C. 10)) brought a set of provisions from the Data (Use and Access) Act 2025 into force. The commencement is part of stage 3 of the government's four-stage implementation plan for the Act, and includes changes to the existing data protection framework. Specifically, the provisions coming into force make changes to the UK GDPR, supplying additional criteria for determining whether controllers or processors can rely on legitimate interest as a legal basis for processing personal data, as well as whether further processing can be considered compatible with the original purpose. The new provisions also make changes to the time limit within which controllers have to respond to data subject requests, as well as to the information which controllers are required to provide data subjects when collecting personal data about them. Further, the new provisions introduce higher protection standards for children to the existing requirements for data protection by design.