Legislation – Data (Use and Access) Act 2025
Changes to legislation:
Data (Use and Access) Act 2025, Schedule 10 is up to date with all changes known to be in force on or before 04 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.
Changes to Legislation
Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.
Schedule 10Complaints: minor and consequential amendments
The UK GDPR
1
The UK GDPR is amended as follows.
2
In Article 12(4) (transparent information, communication and modalities for the exercise of the rights of the data subject), for “lodging a complaint with the Commissioner” substitute “making a complaint to the controller under section 164A of the 2018 Act, making a complaint to the Commissioner under section 165 of that Act”
.
3
(1)
Article 13(2) (information to be provided where personal data is collected from the data subject) is amended as follows.
(2)
“(ca)
the right to make a complaint to the controller under section 164A of the 2018 Act;”.
(3)
In point (d), for “lodge a complaint with the Commissioner” substitute “make a complaint to the Commissioner under section 165 of the 2018 Act”
.
4
(1)
Article 14(2) (information to be provided where personal data is not obtained from the data subject) is amended as follows.
(2)
“(da)
the right to make a complaint to the controller (see section 164A of the 2018 Act);”.
(3)
In point (e), for “lodge a complaint with the Commissioner” substitute “make a complaint to the Commissioner under section 165 of the 2018 Act”
.
5
(1)
Article 15(1) (right of access by the data subject) is amended as follows.
(2)
“(ea)
the right to make a complaint to the controller under section 164A of the 2018 Act;”.
(3)
In point (f), for “lodge a complaint with the Commissioner” substitute “make a complaint to the Commissioner under section 165 of the 2018 Act”
.
6
In Article 47 (binding corporate rules), in paragraph 2(e), for “lodge a complaint with the Commissioner and” substitute “make a complaint to the controller under section 164A of the 2018 Act, the right to make a complaint to the Commissioner under section 165 of the 2018 Act, the right to lodge a complaint”
.
7
(1)
Article 80 (representation of data subjects) is amended as follows.
(2)
In paragraph 1—
(a)
for “lodge the complaint” substitute “make a complaint under section 164A or 165 of the 2018 Act”
, and
(b)
omit “77,”.
(3)
In paragraph 2, for “lodge a complaint with the Commissioner” substitute “make a complaint under section 164A or 165 of the 2018 Act”
.
The 2018 Act
8
The 2018 Act is amended as follows.
9
In section 26(2)(f) (national security and defence exemption), omit sub-paragraph (ai) (inserted by section 88 of this Act).
10
(1)
Section 44 (information: controller’s general duties) is amended as follows.
(2)
In subsection (1)—
(a)
“(da)
the existence of the right to make a complaint to the controller (see section 164A);”, and
(b)
in paragraph (e), after “Commissioner”, in the first place it occurs, insert “(see section 165)”
.
(3)
In subsection (5)—
(a)
“(ca)
of the data subject’s right to make a complaint to the controller under section 164A,”, and
(b)
in paragraph (d), after “Commissioner” insert “under section 165”
.
11
(1)
Section 45 (right of access by the data subject) is amended as follows.
(2)
In subsection (2)—
(a)
“(ea)
the existence of the data subject’s right to make a complaint to the controller (see section 164A);”, and
(b)
in paragraph (f), after “the Commissioner”, in the first place it occurs, insert “(see section 165)”
.
(3)
In subsection (5)—
(a)
“(ca)
of the data subject’s right to make a complaint to the controller under section 164A,”, and
(b)
in paragraph (d), at the end insert “under section 165”
.
12
13
(1)
Section 48 (rights to rectification, to erasure or to restriction of processing: supplementary) is amended as follows.
(2)
In subsection (1)(b)—
(a)
“(iia)
of the data subject’s right to make a complaint to the controller under section 164A,”, and
(b)
in sub-paragraph (iii), after “Commissioner” insert “under section 165”
.
(3)
In subsection (4)—
(a)
“(ba)
of the data subject’s right to make a complaint to the controller under section 164A,”, and
(b)
in paragraph (c), after “Commissioner” insert “under section 165”
.
14
In section 93(1)(e) (right to information), after “Commissioner”, in the first place it occurs, insert “under section 165”
.
15
In section 94(2)(f) (right of access), after “Commissioner”, in the first place it occurs, insert “under section 165”
.
16
(1)
Section 149 (enforcement notices) is amended as follows.
(2)
In subsection (1), for “or (5)” substitute “, (5) or (5A)”
.
(3)
(4)
In subsection (6), for “or (5)” substitute “, (5) or (5A)”
.
17
In section 155 (penalty notices), in subsection (1)(a), for “or (5)” substitute “, (5) or (5A)”
.
18
19
In section 165 (complaints by data subjects), in the heading, at the end insert “to the Commissioner”
.
20
(1)
Section 166 (orders to progress complaints) is amended as follows.
(2)
In the heading, at the end insert “to the Commissioner”
.
(3)
In subsection (1), omit “or Article 77 of the UK GDPR”.
21
(1)
Section 187 (representation of data subjects with their authority) is amended as follows.
(2)
In subsection (1)(a)—
(a)
for “Articles 77,” substitute “sections 164A and 165 (complaints) and Articles”
, and
(b)
omit “to lodge complaints and”.
(3)
In subsection (2)—
(a)
“(za)
the right under section 164A (complaints to the controller);”, and
(b)
in paragraph (a), for “165(2) and (4)(d)” substitute “165”
.