Legislation – The Victims and Prisoners Act 2024 (Commencement No. 10) and Data (Use and Access) Act 2025 (Commencement No. 8) Regulations 2026

These Regulations bring into force specified provisions of the Victims and Prisoners Act 2024 (c. 21) (“the 2024 Act”) and the Data (Use and Access) Act 2025 (c. 18) (“the 2025 Act”) on 31st March 2026. These are the tenth commencement Regulations made under the 2024 Act and the eighth commencement Regulations made under the 2025 Act.

Regulation 2 brings into force section 31 of the 2024 Act. Section 31 makes amendments to Article 17 of Regulation (EU) 2016/679 of the European Parliament, known as the UK General Data Protection Regulation (“UK GDPR”), and the Data Protection Act 2018. Article 17 of the UK GDPR (‘right to erasure’) provides for the circumstances in which data subjects have a right to have personal data erased. The right to erasure is not absolute and does not apply if processing is necessary for one of the reasons specified in Article 17(3), including where processing is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority.

Section 31(2) of the 2024 Act adds a new ground to Article 17(1) of the UK GDPR, Article 17(1)(g), which provides that data subjects have the right to have their personal data erased where it has been processed as a result of an allegation about the data subject that meets the criteria specified in Article 17(1)(g). This provides that the allegation must have been made by a person who is a malicious person in relation to the data subject, have been investigated by the data controller and the controller must have decided that no further action is to be taken in relation to the allegation. Section 31(3) of the 2024 Act amends Article 17 to insert additional paragraphs that provide a definition of a “malicious person” for the purposes of Article 17(1)(g). A “malicious person” is someone who: (a) has been convicted of an offence of stalking or harassment (including breach of a stalking protection order) in relation to the data subject (the victim of that offence); or (b) is subject to a stalking protection order made to protect the data subject from a risk associated with stalking. These changes mean that victims of stalking and harassment can request erasure of their personal data when that data has been processed as a result of an unfounded allegation made by their perpetrator.

Regulation 3 brings into force paragraph 32 of Schedule 11 to the 2025 Act. Paragraph 32 ensures that the amendments made by section 31 of the 2024 Act extend to the United Kingdom to align with the extent of the UK GDPR itself.

A full impact assessment has not been produced for this instrument as no, or no significant, impact on the private, voluntary or public sector is foreseen.