Data (Use and Access) Act 2025: Key changes now in force

05 February 2026

Bethany Paliga and Claire Archibald

On Wednesday 4 February 2026, it was announced that many of the data protection reforms contained within the Data (Use and Access) Act 2025 will come into force on Thursday 5 February 2026.

The Data (Use and Access) Act 2025 received Royal Assent in June 2025 and made some changes to data protection law in the UK, although some of the key changes were not immediately brought into force.

Changes now in force

From 5 February 2026, there will be some refinement to data protection law. The changes being introduced will not mean that schools and trusts will become uncompliant with data protection law but may mean that you miss opportunities to take advantage of some changes being introduced.

The key changes introduced on 5 February 2026 for schools and trusts include:

Introduction of the new ‘relevant time period’ confirming that the time period for responding to subject access requests (SARs) does not commence until you have received all the information you require to process the request (e.g., ID or authorisation).
Ability to ‘stop the clock’ on time limit for responding to SARs.
Introduction of the new ‘recognised legitimate interests’ lawful basis for processing personal data.
Extension of the purpose limitation principle, where certain processing activities are deemed compatible with the original purpose for processing.
Enhanced ICO powers.

Complaints

The Data (Use and Access) Act 2025 also introduces a right for individuals to make a complaint to an organisation about the way in which their personal data has been handled. This reform introduces an obligation on schools and trusts to facilitate data protection related complaints and respond to complaints without undue delay.

The provisions relating to complaints will come into force on 19 June 2026.

Our top tips for schools

We're here to help schools and trusts prepare for changes to data protection law and improve data protection compliance. Our top tips are:

Update your data protection documents: Ensure your data protection policies and procedures are up to date and take advantage of the changes introduced by the Data (Use and Access) Act 2025 where necessary.
Complaints: Consider how you are going to facilitate and deal with data protection complaints when this comes into force in June 2026. Review your data protection policy to ensure it refers to the ability to make data protection complaints and who to direct them to. Your existing complaints procedures may also need to be revisited to confirm that data protection complaints will be dealt with in accordance with the statutory complaints process under data protection law, rather than the school’s complaints procedure.

Support and resources

Our data protection support pack for schools and trusts contains detailed guidance and template documentation to assist with your data protection compliance. These documents have recently been updated to reflect the changes introduced by the Data (Use and Access) Act 2025.

Our data protection CPD programmes help you develop the skills and confidence to handle data protection effectively. Our support packs equip you with the resources to do it efficiently.