Legislation – Data (Use and Access) Act 2025

Revised legislation carried on this site may not be fully up to date. At the current time any known changes or effects made by subsequent legislation have been applied to the text of the legislation you are viewing by the editorial team. Please see ‘Frequently Asked Questions’ for details regarding the timescales for which new effects are identified and recorded on this site.

Part 8Final provisions

139Power to make consequential amendments

(1)

The Secretary of State may by regulations make provision that is consequential on any provision made by this Act.

(2)

Regulations under this section—

(a)

may make different provision for different purposes;

(b)

may include transitional, transitory or saving provision;

(c)

may amend, repeal or revoke any provision made by an enactment.

(3)

The reference in subsection (2)(c) to provision made by an enactment is—

(a)

where the amendment, repeal or revocation is consequential on section 117, 118 or 119(1) or Schedule 14, a reference to provision made by an enactment whenever passed or made (including this Act), and

(b)

in any other case, a reference to provision made by an enactment passed or made before the end of the Session in which this Act is passed.

(4)

Regulations under this section made in consequence of section 183A of the Data Protection Act 2018 (inserted by section 106 of this Act) may amend, repeal or revoke provision which refers to the data protection legislation (as defined in section 3 of the Data Protection Act 2018) as they could if the provision referred instead to the main data protection legislation (as defined in section 183A of that Act).

(5)

Regulations under this section that amend, repeal or revoke primary legislation are subject to the affirmative resolution procedure.

(6)

Any other regulations under this section are subject to the negative resolution procedure.

(7)

In this section—

“enactment” includes—

(a)

an enactment comprised in subordinate legislation (as defined in section 21 of the Interpretation Act 1978),

(b)

an enactment comprised in, or in an instrument made under, a Measure or Act of Senedd Cymru,

(c)

an enactment comprised in, or in an instrument made under, an Act of the Scottish Parliament,

(d)

an enactment comprised in, or in an instrument made under, Northern Ireland legislation, and

(e)

assimilated direct legislation;

“primary legislation” means—

(a)

an Act of Parliament;

(b)

an Act of the Scottish Parliament;

(c)

a Measure or Act of Senedd Cymru;

(d)

Northern Ireland legislation.

140Regulations

(1)

Regulations under this Act are to be made by statutory instrument.

(2)

Where regulations under this Act are subject to “the affirmative resolution procedure” the regulations may not be made unless a draft of the statutory instrument containing them has been laid before Parliament and approved by a resolution of each House of Parliament.

(3)

Where regulations under this Act are subject to “the negative resolution procedure” the statutory instrument containing the regulations is subject to annulment in pursuance of a resolution of either House of Parliament.

(4)

Any provision that may be included in regulations under this Act made by the Secretary of State or the Treasury subject to the negative resolution procedure may be made by regulations subject to the affirmative resolution procedure.

141Extent

(1)

This Act extends to England and Wales, Scotland and Northern Ireland, subject to subsections (2) to (5).

(2)

In Part 3 (National Underground Asset Register)—

(a)

sections 56, 57(1) to (7) and 60(1) and Schedule 1 extend to England and Wales only, and

(b)

sections 58, 59 and 60(2) and Schedule 2 extend to Northern Ireland only.

(3)

In Part 4 (registers of births and deaths)—

(a)

sections 61 to 64 extend to England and Wales only, and

(b)

an amendment or repeal made by Schedule 3 (minor and consequential amendments) has the same extent as the enactment amended or repealed.

(4)

In Part 6 (the Information Commission), paragraph 23 of Schedule 12A to the Data Protection Act 2018 (inserted by Schedule 14 to this Act) extends to England and Wales and Northern Ireland only.

(5)

In Part 7—

(a)

section 121 and Schedule 15 (information standards for health and adult social care) extend to England and Wales only;

(b)

paragraphs 2, 3 and 5 to 7 of Schedule 16 (grant of smart meter communication licences) extend to England and Wales and Scotland only;

(c)

section 138(1) to (3) and (6) (creating, or requesting the creation of, purported intimate image of adult) extend to England and Wales only;

(d)

section 138(4) (amendment of the Armed Forces Act 2006) extends to—

(i)

England and Wales, Scotland and Northern Ireland,

(ii)

the Isle of Man, and

(iii)

the British overseas territories, except Gibraltar;

(e)

section 138(5) (amendment of the Serious Crime Act 2007) extends to England and Wales and Northern Ireland only.

(6)

The powers conferred by section 384(1) and (2) of the Armed Forces Act 2006 (powers to extend provisions to the Channel Islands and to make provisions apply with modifications as they extend to the Channel Islands, the Isle of Man and British overseas territories other than Gibraltar) may be exercised in relation to section 177DA of that Act (inserted by section 138(4) of this Act).

(7)

The power conferred by section 63(3) of the Immigration, Asylum and Nationality Act 2006 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment made by section 55 of this Act of any part of that Act (with or without modification or adaptation).

(8)

The power conferred by section 76(6) of the Immigration Act 2014 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment made by section 55 of this Act of any part of that Act (with or without modifications).

(9)

The power conferred by section 95(5) of the Immigration Act 2016 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment made by section 55 of this Act of any part of that Act (with or without modifications).

(10)

The power conferred by section 239(7) of the Online Safety Act 2023 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment or repeal made by this Act of any part of that Act (with or without modifications).

(11)

In this section, “enactment” has the same meaning as in section 139.

142Commencement

(1)

Except as provided by subsections (2) to (4), this Act comes into force on such day as the Secretary of State may by regulations appoint.

(2)

The following provisions come into force on the day on which this Act is passed—

(a)

section 66 (meaning of “the 2018 Act” and “the UK GDPR”);

(b)

section 78 (searches in response to data subjects’ requests);

(c)

Part 1 of Schedule 16 (grant of smart meter communication licences) and section 122 so far as relating to that Part of that Schedule;

(d)

section 126 (retention of biometric data and recordable offences);

(e)

section 127 (retention of pseudonymised biometric data);

(f)

section 128 (retention of biometric data from INTERPOL);

(g)

this Part;

(h)

any other provision of this Act (including provision modifying other legislation) so far as it confers power to make regulations or is otherwise necessary for enabling the exercise of such a power on or after the day on which this Act is passed.

(3)

The following provisions come into force at the end of the period of two months beginning with the day on which this Act is passed—

(a)

section 69 (consent to law enforcement processing);

(b)

section 82 (logging of law enforcement processing);

(c)

section 96 (notices from the Information Commissioner);

(d)

section 97 (power of the Information Commissioner to require documents).

(4)

Part 2 of Schedule 16 (grant of smart meter communication licences), and section 122 so far as relating to that Part of that Schedule, come into force on the day on which the first regulations under section 91A(1) of the Energy Act 2008 (inserted by Part 1 of Schedule 16) come into force.

(5)

Regulations under this section may make different provision for different purposes.

143Transitional, transitory and saving provision

(1)

The Secretary of State may by regulations make transitional, transitory or saving provision in connection with the coming into force of any provision of this Act.

(2)

Regulations under this section may amend Schedule 21 to the Data Protection Act 2018 or Part 2 of Schedule 9 to this Act by adding, varying or repealing provision.

(3)

Regulations under this section containing provision described in subsection (2) are subject to the negative resolution procedure.

(4)

Regulations under this section may make different provision for different purposes.

144Short title

This Act may be cited as the Data (Use and Access) Act 2025.