HomeSearch

Lenses
Business lenslens
Certifying body lenslens
End user / data subject lenslens
Front-line staff lenslens
Government lenslens
Human rights / privacy advocate lenslens
Policymaker (Government lens)lens
Regulator / enforcer (Government lens)lens
Africa
Egyptplanned
Ghanaplanned
Kenyaplanned
Moroccoplanned
Nigeriaplanned
Rwandaplanned
South Africaplanned
Asia-Pacific
Australiaplanned
Chinadrafting
Hong Kongplanned
Indiaplanned
Indonesiaplanned
Japanplanned
Malaysiaplanned
New Zealandplanned
Philippinesplanned
Singaporeplanned
South Koreaplanned
Thailandplanned
Vietnamplanned
Europe
European Uniondrafting
Switzerlandplanned
Türkiyeplanned
United Kingdomplanned
Latin America
Argentinaplanned
Brazilplanned
Chileplanned
Colombiaplanned
Peruplanned
Uruguayplanned
Middle East
Bahrainplanned
Israelplanned
Qatarplanned
Saudi Arabiaplanned
United Arab Emiratesplanned
North America
Canadaplanned
Mexicoplanned
United States (federal)drafting
United States
Californiadrafting
Coloradoplanned
Connecticutplanned
Delawareplanned
Floridaplanned
Indianaplanned
Iowaplanned
Kentuckyplanned
Marylandplanned
Minnesotaplanned
Montanaplanned
Nebraskaplanned
New Hampshireplanned
New Jerseyplanned
Ohioplanned
Oregonplanned
Rhode Islandplanned
Tennesseeplanned
Texasplanned
Utahplanned
Virginiaplanned
Menu

United Kingdom

Coverage plannedAlso: Britain, England, Scotland, Wales, Northern Ireland, UK GDPR, ICO

VERIFIED 2026-09-17 · REVIEW BY 2027-03-16

Most of the data protection changes in Part 5 of the Data (Use and Access) Act 2025 came into force on 5 February 2026; the complaints provisions on 19 June 2026.

Instruments

No instrument recorded for United Kingdom yet.

Regulator

Exercisable rights

Access, rectification and erasure. Since 19 June 2026 you may complain to the controller, which must acknowledge within 30 days, and you can complain to the ICO free of charge

Through each lens

End user / data subject

What can I actually do about this today, and what does it cost me.

No end user / data subject analysis for United Kingdom yet.

Business

What does this obligate us to build, and by when.

No business analysis for United Kingdom yet.

Government

Government is one lens carrying two sub-lenses, each with judicial reviewability analysis.

No government analysis for United Kingdom yet.

Policymaker

What did the drafters intend, and what did the text achieve.

No policymaker analysis for United Kingdom yet.

Regulator / enforcer

What can this authority make stick on appeal.

No regulator / enforcer analysis for United Kingdom yet.

Certifying body

What is the scope of what we are attesting to.

No certifying body analysis for United Kingdom yet.

Front-line staff

What do I do when this lands on my desk.

No front-line staff analysis for United Kingdom yet.

Human rights / privacy advocate

Who does this regime fail, and can that be shown.

No human rights / privacy advocate analysis for United Kingdom yet.

Sources

  1. UK GDPR (legislation.gov.uk, up to date to 17 September 2026), Arts. 15, 16, 17 and 57(3); Art. 77 omitted from 19 June 2026 · retrieved 2026-09-17 · https://www.legislation.gov.uk/eur/2016/679/contents
  2. Data Protection Act 2018, ss. 164A and 165(2) · retrieved 2026-09-17 · https://www.legislation.gov.uk/ukpga/2018/12/section/164A
  3. DSIT, Data (Use and Access) Act 2025: plans for commencement, Commencement No. 6 Regulations 2026: majority of Part 5 from 5 February 2026 · retrieved 2026-09-17 · https://www.gov.uk/guidance/data-use-and-access-act-2025-plans-for-commencement