Data (Use and Access) Act 2025 – Key Reforms Now Taking Effect
As of 5th February 2026, a number of data protection reforms introduced by the Data (Use and Access) Act 2025would come into force.
Although the Act received Royal Assent in June 2025, several of its most significant provisions were delayed. These reforms are now being implemented in stages.
Changes taking effect from 5 February 2026
The reforms coming into force from February2026 refine, rather than overhaul, the existing data protection framework. Schools and trusts are unlikely to find themselves non-compliant as a result of these changes. However, organisations may miss valuable opportunities to streamline processes or rely on new flexibilities if the changes are not understood and implemented.
For schools and trusts, the key changes include:
- A new “relevant time period” for subject access requests (SARs), confirming that the response deadline does not begin until the organisation has received all information reasonably required to process the request (such as proof of identity or authority).
- A new ability to pause the SAR response timeframe where further clarification or information is needed from the requester.
- Introduction of a “recognised legitimate interests” lawful basis for processing personal data.
- Expansion of the purpose limitation principle, allowing certain further processing activities to be treated as compatible with the original purpose for which data was collected.
- Strengthened enforcement powers for the Information Commissioner’s Office (ICO).
New data protection complaints duty
The Act also introduces a new right for individuals to raise a direct complaint with an organisation about how their personal data has been handled.
This reform places a duty on schools andtrusts to:
- Provide a clear route for data protection complaints, and
- Respond to such complaints without undue delay.
These complaint-handling provisions will come into force on 19 June 2026.
Practical next steps for schools and trusts
To prepare for the changes and strengthen data protection compliance, schools and trusts should consider the following actions:
- Review and update documentation
Check that data protection policies, procedures and SAR processes reflect the new rules and take advantage of the flexibilities introduced by the Act where appropriate.
- Prepare for data protection complaints
Start planning how data protection complaints will be managed ahead of June 2026. Policies should clearly explain how individuals can raise a data protection complaint and who these should be directed to.
- Existing complaints procedures may also need to be reviewed to ensure that data protection complaints are handled under the statutory data protection framework, rather than the school’s general complaints process