United Kingdom: Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 including cross-border data transfer regulation enter into force

On 5 February 2026, the Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (2026 No. 82 (C. 10)) brought a set of provisions from the Data (Use and Access) Act 2025 into force. The commencement is part of stage 3 of the government's four-stage implementation plan for the Act, and includes changes to the existing data protection framework. Specifically, the provisions coming into force make changes to the UK GDPR, fully replacing the system of adequacy decisions with ministerial regulations approving personal data transfers to third countries or international organisations. Regulations are based on a data protection test to ensure that general data protection rules in the destination are not materially lower, and should be monitored continuously. The rules on adequate safeguards are also aligned with the standards of the data protection test.