UK Data Act rollout: what businesses must check now

Britain’s Data (Use and Access) Act 2025 is becoming operational through a succession of regulations, rather than a single switch-on. According to DSIT’s commencement guidance, most data-protection and privacy provisions took effect on 5 February 2026, followed by the transfer of regulatory functions to the new Information Commission on 30 September. For businesses, the important distinction is between provisions explicitly brought into force and dates that remain forecasts in the government’s account.

What happened

DSIT’s guidance, updated on 12 October 2026 with a summary of stage-four regulations, describes implementation across four broad stages. The Act received Royal Assent on 19 June 2025. Some provisions take effect automatically under section 142; many others require commencement regulations. Passage through Parliament was therefore not a universal compliance deadline.

The largest change for ordinary data-processing businesses came through Commencement No. 6. These regulations brought most of Part 5’s data-protection and privacy provisions into force on 5 February 2026. DSIT describes them as simplifying aspects of the UK GDPR and modernising the Information Commissioner’s enforcement powers. The summary does not enumerate those changes, so it cannot establish which individual processing activities now qualify for different treatment.

Commencement No. 9 subsequently abolished the office of the Information Commissioner and transferred its functions to the Information Commission from 30 September 2026. It also established transitional and accounting arrangements. This is a statutory restructuring with continuity of functions, not the disappearance of the regulator or its remit.

A separate change took effect on 31 March 2026. Joint commencement regulations under the Victims and Prisoners Act 2024 and the data Act added a ground for requesting erasure under Article 17 of the UK GDPR. It concerns personal data processed as a result of an unfounded allegation made by a legally defined malicious person.

That definition is narrow: someone convicted of stalking or harassment against the person concerned, or subject to a stalking protection order protecting them. The provision does not create a general deletion right whenever somebody disputes an allegation. Businesses handling such requests will need to distinguish the statutory circumstances from an ordinary disagreement over a record.

The background

The Act spans considerably more than privacy compliance. Its opening stage covered technical clarifications and measures concerning AI and copyright. The first commencement regulations took effect on 20 August 2025, introducing new statutory objectives for the ICO and requirements for government to prepare an AI-and-copyright progress update and report.

The wider rollout plan also refers to an impact assessment on those issues. These are obligations to investigate and report, not, on the evidence of this guidance, a settlement of whether particular copyright works may be used in AI systems. A business procuring a model cannot read a reporting requirement as permission to use protected material.

Digital identity has its own timetable. Commencement No. 4 brought most of Part 2 into force on 1 December 2025, placing the UK digital identity and attributes trust framework, statutory register and related measures on a statutory footing. The Office for Digital Identities and Attributes maintains them. For verification suppliers and their customers, this is a separate implementation track from February’s privacy changes.

Other provisions address information preservation rather than deletion. Section 124 commenced on 30 September 2025, amending the Online Safety Act 2023. It requires Ofcom to issue information-retention notices to social-media providers and other regulated services when required by a coroner or procurator fiscal investigating a child’s death. That is a specific investigatory mechanism, not a blanket instruction to retain all user data.

The Act also reaches public-sector processing. Commencement No. 3 covers sections 79, 88, 89 and 90, amending the Data Protection Act 2018 rules for law enforcement and intelligence services. Another set of regulations extends information-sharing powers under the Digital Economy Act 2017 so public authorities can share information to support businesses and charities. Neither measure should be mistaken for general permission for companies to exchange customer records.

What people are saying

The source contains the government’s implementation account, not a collection of industry reactions. DSIT’s stated approach is staged commencement, with longer lead times where institutional or technical preparations are needed. Its emphasis on simplification sits alongside changes to enforcement powers: less friction in parts of the framework does not, by itself, mean less regulatory exposure.

The original timetable makes the government’s operational reasoning explicit. Measures concerning the National Underground Register and electronic registration of births and deaths depend on suitable technology being available. Legal authority and a working system are different deliverables. The guidance places both within the longer-lead-time stage without giving a confirmed commencement date for either in the supplied summary.

For the regulator, DSIT says the ICO is publishing and updating guidance to reflect the data-protection changes. It directs readers to separate government factsheets for further detail. The commencement page consequently answers when broad groups of provisions start, but is not a substitute for the substantive rules or guidance on their application.

The document also illustrates the limits of an evolving implementation page. Its original plan expected changes to ICO governance in early 2026, once members of the new board had been appointed. The later regulations specify the transfer on 30 September 2026. Both statements remain in the account; the dated commencement provision is the firmer basis for establishing when the transfer occurred.

Murray Wilkinson, founder of Found Revenue, an AI business services provider with three UK locations, says smaller businesses should treat the change as a prompt to review what customer data their AI tools use and who supplies them, rather than waiting for enforcement.

What happens next

The most consequential unresolved point in this summary concerns complaints. The original stage-three plan expressly excluded section 103, covering complaints by data subjects. Controllers’ obligations to establish complaint-handling processes were expected to commence approximately 12 months after Royal Assent. The supplied account does not confirm their actual commencement date. That forecast should neither be presented as proof of activation nor taken as proof that the obligations remain dormant.

The stage numbers also need careful reading. Four implementation stages have produced nine numbered commencement instruments under the Act in this account, some combined with regulations under other legislation. A reference to stage four therefore does not mean Commencement No. 4. Confusing the two would send a reader from the later implementation package back to digital identity.

AI businesses have another distinct provision to identify. Section 138 took effect on 6 February 2026, creating offences relating to creating, or requesting the creation of, purported intimate images of an adult without consent or reasonable belief in consent. This criminal-law measure is separate from the government’s AI-and-copyright reporting obligations; treating both as a single AI reform would obscure their different consequences.

For UK firms and US companies assessing UK-facing operations, the remaining task is provision-specific. DSIT expressly says its staged account is not a complete list of the Act’s measures. Nor does it resolve adjacent questions about AI security, explored in our coverage of the UK cyber bill’s unresolved AI safeguards. Establishing a commencement date is necessary legal housekeeping; establishing which rule applies to a product or process is the separate, more demanding job.