Data (Use and Access) Bill receives Royal Assent

The Data (Use and Access) Bill received Royal Assent on June 19, 2025.

The Data (Use and Access) Act 2025 makes a number of changes to the Data Protection Act 2028 and the UK GDPR, including:

• Extending the time for response to a subject access request in certain circumstances.
• Limiting searches in response to subject access requests to those that are “reasonable and proportionate”.
• Setting out a clearer framework for international transfers of personal data.

The current Information Commissioner’s Office is due to be replaced with a new Information Commission, but has meanwhile provided some useful guidance on the new law.

While most of the new Act’s provisions will come into force under future regulations, a limited number of provisions came into force upon Royal Assent. One of those in force now relates to the second bullet point above, that of reasonable and proportionate searches for data subject access requests.