Data (Use and Access) Act 2025
The changes most relevant to people using this site. The data-protection provisions are now in force; this is no longer a “forthcoming changes” page.
Status in September 2026
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. Its data-protection changes were commenced in stages. Most remaining data-protection provisions came into force on 5 February 2026, and the new controller complaint-handling duties came into force on 19 June 2026. ICO public guidance now describes the data-protection provisions as in force.
Changes most relevant to SARs
Reasonable and proportionate searches
The legislation makes explicit that an organisation responding to a person's information request is required to conduct reasonable and proportionate searches for the relevant information.
Clarification and stopping the clock
The current right-of-access regime expressly provides for clarification where reasonably required. The SAR time limit pauses on the day clarification is requested and resumes the day after it is received.
Complaints to controllers
Controllers must provide a way to make data-protection complaints, acknowledge complaints within 30 days, investigate appropriately and provide an outcome without unjustifiable or excessive delay.
What did not disappear
The DUAA amends the existing UK data-protection framework; it did not abolish or replace the UK GDPR and Data Protection Act 2018 as the central framework for individual rights. The ordinary SAR deadline remains one calendar month, with the possibility of up to two further months for qualifying complex or numerous requests.
Why old “coming soon” wording is now wrong
Pages written in 2025 or early 2026 often described the complaint duty as future law or said DUAA changes were still being implemented. That is now stale. WWTR's substantive pages have been updated to treat the relevant provisions as current law while continuing to link to the ICO's latest topic-specific guidance.
Official sources
- ICO – DUAA: how the Act affects the public
- ICO – DUAA data-protection changes
- ICO – February 2026 commencement statement
- ICO – June 2026 complaints law
- Data (Use and Access) Act 2025
Reviewed September 2026. This page is general information, not legal advice. For a live dispute or critical deadline, check the current ICO guidance and legislation.