[co-author: Anton Strukoff]
COMMENCEMENT REGULATIONS
In our previous newsletter, we explained how the new UK Data (Use and Access) Act 2025 (“DUA Act”), which modifies the UK’s data and e-privacy regime, has a phased commencement such that most of the provisions require the enactment of further regulations to come into effect.
While the DUA Act provides that certain provisions would commence upon Royal Assent on June 19, 2025 (e.g., stating that searches in response to data subject requests need only be reasonable and proportionate), and that others would commence on August 19, 2025 (e.g., empowering the Information Commissioner or “IC” – a new regulator that shall replace the ICO – to require documents from data controllers), the government has now announced that it will establish further commencement regulations through four ‘Stages’. The first set of regulations was enacted on July 21, 2025 (“Stage 1 Regulations”) and triggers the operation from August 20, 2025 of parts of the DUA Act that amend certain aspects of UK GDPR and the e-privacy rules (under the Privacy and Electronic Communications Regulations 2003 (“PECR”)). Stage 2 will begin three to four months after Royal Assent, Stage 3 is expected to begin six months following Royal Assent and Stage 4 is expected to begin more than six months after Royal Assent.
The Stage 1 Regulations bring into effect provisions which include the following:
- the Secretary of State may expand the list of special categories of personal data;
- data breach notifications under PECR must be made within 72 hours to the IC (to align with UK GDPR); and
- the government may request that the IC produces codes of conduct on good practice in data processing (a code of conduct on automated decision-making is expected).
The Stage 1 Regulations also trigger commencement of the obligations on the government to report on issues pertaining to artificial intelligence and copyright, which are discussed in greater depth in the June issue of this newsletter. Moving forward, the second stage will bring into effect the rules concerning digital verifications services.
SMART DATA SCHEMES
Another focal point of the DUA Act is the framework set out in relation to Smart Data schemes, driven by the government’s Industrial Strategy to establish the UK as a leader in data-based innovation. Smart Data is a type of data interoperability (i.e., data sharing) relating to the secure sharing of specified data to third parties. The DUA Act grants the government with regulation-making powers relating to the sharing of (i) customer data, and (ii) business data. With respect to customer data, businesses can be required to share, upon a customer’s request, customer data with an authorized third party with the aim of enabling the customer to access products and services. With respect to business data, businesses can be required to publish data about their own products and services such as regarding availability, price, or information about feedback, use, performance or quality.
A Smart Data scheme is an arrangement governing how Smart Data shall operate in a particular sector, for example, the data to be shared between a data holder and an authorized third party or the process for customer authorization. The government has now issued a ‘call for evidence’ to obtain stakeholders’ feedback on the following issues with respect to roll out of Smart Data schemes in digital markets:
- are there specific data access issues in digital markets that might be addressed through a Smart Data scheme;
- if so, what are the possible use cases that would be supported by a Smart Data scheme that addresses them;
- what key design features does a Smart Data scheme need to support these use cases;
- any initial views on the costs and benefits of a Smart Data scheme that addresses any issues which are identified; and
- any other preliminary views stakeholders might have on the use of Smart Data in digital markets more broadly.
The government would like to hear views from a range of organizations including consumer groups, industry groups, academia and any organizations or people with experience in data sharing. If your organization is interested, note that the call for evidence remains open until September 15, 2025.
