The UK rewrote parts of its data protection law in 2025, and most of the changes now apply. The Data (Use and Access) Act is not a new GDPR. It amends the UK GDPR, the Data Protection Act 2018 and the cookie rules in PECR. For teams that collect public web data, a few of those amendments matter a great deal, and some popular readings of them go too far.
This guide covers what is in force, what changed for lawful basis, research, notices, cookies, automated decisions and transfers, and what the Act did not change. It is general information, not legal advice.
What is in force, and when
The Act received Royal Assent on 19 June 2025 and was brought into force in stages by commencement regulations.
| Date | What took effect |
|---|---|
| 19 June 2025 | ”Reasonable and proportionate” searches for access requests |
| 20 August 2025 | Smart data powers, and the duty to report on copyright and AI |
| 1 December 2025 | Digital verification services framework |
| 5 February 2026 | The main UK GDPR and PECR changes: lawful basis, research, notices, automated decisions, transfers, cookies, fines |
| 19 June 2026 | Controllers must run a complaints process |
| 30 September 2026 | The Information Commissioner’s Office becomes the Information Commission |
So when people talk about “the new UK rules”, they mostly mean the package that started on 5 February 2026.
Lawful basis: less changed than you may have heard
The Act adds a new lawful basis, recognised legitimate interests. Processing is lawful if it is necessary for one of the purposes on a fixed list, with no balancing test. The list covers public-interest purposes: disclosures to public bodies, national security and defence, emergencies, crime and safeguarding vulnerable people. Ordinary commercial data collection is not on it.
For commercial work, the familiar legitimate interests basis is unchanged. It still applies only where your interests are not “overridden by the interests or fundamental rights and freedoms of the data subject”. The Act does add examples of processing that can be a legitimate interest, including direct marketing, sharing within a group for internal administration and network security. Those are examples, not passes: the balancing test still applies.
For scraping specifically, the regulator’s view has not moved. In its December 2024 response to its consultation on generative AI, it said legitimate interests is the only lawful basis likely to be available for training generative AI on web-scraped personal data, and only when the developer passes the three-part test of purpose, necessity and balance. It also treats scraping as high-risk, largely invisible processing. Our guide to what legal will ask before a scraping project covers how to prepare that case.
Research is defined more broadly
The Act writes a definition of scientific research into the UK GDPR. It means “any research that can reasonably be described as scientific, whether publicly or privately funded and whether carried out as a commercial or non-commercial activity”, and it includes technological development and applied research.
This matters because research purposes carry useful exemptions, including the notice exemption below. But the test is still “reasonably described as scientific”, so not every analytics project qualifies. Statistical purposes have a tighter definition too: the results must be aggregate data that is not personal data, and must not be used to make decisions about a particular person.
The Act also allows “broad consent” to an area of research where the purposes cannot be fully identified at the start. That helps studies with participants, but is of little use for scraped data, where nobody has been asked.
Telling people: the notice question
Scraped personal data is data not obtained from the person, so Article 14 of the UK GDPR applies: in principle, you must give people a privacy notice. Contacting everyone in a large dataset is rarely possible, and the Act now spells out when you may rely on an exemption.
| Exemption | What it says |
|---|---|
| Article 14(5)(e) | Providing the information “is impossible or would involve a disproportionate effort” |
| Article 14(5)(f) | Notice would “render impossible or seriously impair” the purpose of the processing |
| Article 14(6) | Disproportionate effort depends on “the number of data subjects, the age of the personal data and any appropriate safeguards” |
| Article 14(7) | You must still take appropriate measures, “including by making the information available publicly” |
The practical result: if you rely on disproportionate effort, publish a clear notice about what you collect, from where and why, and how people can object. Keep a record of how you weighed the factors. A separate Article 13 change lets controllers skip a fresh notice when they reuse data only for research, archiving or statistics, under the same impossible or disproportionate effort test.
Cookies and consent walls
PECR now lets sites set some cookies without consent: for statistics on how a service is used, for remembering a visitor’s preferences or improving the site’s appearance, and for strictly necessary purposes such as security and fraud prevention. For the first two, users must get clear information and a simple, free way to object. Fines for cookie and marketing breaches now reach £17.5 million or 4% of worldwide turnover, whichever is higher.
This affects your own sites first. It may also change what crawlers see on UK pages as sites adjust their banners, so check any parsers that rely on a consent wall’s layout. Our study of consent walls by country shows how much those pages already vary.
Automated decisions and transfers
If scraped data feeds decisions about people, such as lead scoring or candidate screening, the rules on automated decisions now apply differently. A solely automated decision with significant effects is no longer generally prohibited, but you must tell people about such decisions, let them make representations, offer human intervention and let them contest the result. Decisions that use special category data stay tightly restricted.
For transfers abroad, the new test is whether protection in the destination is “not materially lower” than in the UK, and exporters may reach that view “acting reasonably and proportionately”. The EU renewed its adequacy decisions for the UK on 19 December 2025, until 27 December 2031, so personal data can keep flowing from the EU to the UK.
What the Act did not change: AI and copyright
The most contested part of the Act is what was left out. The House of Lords repeatedly added amendments requiring AI developers to disclose the copyright works they trained on, and the Commons removed them each time. In exchange, the Act required the government to publish a report on copyright and AI and an economic impact assessment.
Both appeared on 18 March 2026. The report said a broad copyright exception with an opt-out for rightsholders is “no longer the government’s preferred way forward”, and put forward no replacement, choosing to gather more evidence first. So UK copyright law has not moved. The text and data mining exception in section 29A of the Copyright, Designs and Patents Act still covers non-commercial research only. Machine-readable opt-outs carry no special legal weight in the UK yet, though they still signal intent: our guide to robots.txt and AI reservation signals covers how to read them.
What data teams should do
- Check your lawful basis. If you rely on legitimate interests, keep a current assessment. Do not assume the recognised legitimate interests list covers you.
- Test any research claim. Use the research exemptions only for work that can reasonably be called scientific, and document why.
- Publish your notice. If you rely on disproportionate effort, make a public notice that explains collection and objection, and keep your reasoning on file.
- Map decisions about people. List any automated decisions your data feeds and add the safeguards.
- Record where data came from. Keep source URLs, dates and the notice in force at the time. Our guide to provenance in the AI training pipeline shows a workable format.
- Watch the copyright track. The UK has no commercial mining exception today, and the government has said it wants more evidence before it legislates.
Where proxies fit
A proxy changes where a request comes from, not what the law allows. Collecting UK personal data from a UK IP, or from anywhere else, is subject to the same UK GDPR duties. Residential proxies are useful for seeing public UK pages as local visitors see them, for work such as price monitoring, ad verification and checking how consent banners appear. They do not change your lawful basis, your notice duties or anyone’s copyright.
The bottom line
The Data (Use and Access) Act loosened some UK rules, but not the ones most web data teams hoped for. Commercial collection still needs a legitimate interests case with a balancing test. Notice duties are clearer, and publishing a notice is now part of the deal. Research is broader but must be genuinely scientific. On AI training, the copyright question is still open. Document your choices now, while the regulator is still settling into its new name.
Sources and references
- Data (Use and Access) Act 2025, as enacted: legislation.gov.uk
- Section 67, meaning of research and statistical purposes: legislation.gov.uk
- Section 77, information to be provided to data subjects: legislation.gov.uk
- Schedule 4, recognised legitimate interests: legislation.gov.uk
- Schedule 12, storing information in terminal equipment: legislation.gov.uk
- UK GDPR Article 6, as amended: legislation.gov.uk
- Commencement No. 1 Regulations 2025 (SI 2025/904): legislation.gov.uk
- Commencement No. 4 Regulations 2025 (SI 2025/1213): legislation.gov.uk
- Commencement No. 6 Regulations 2026 (SI 2026/82): legislation.gov.uk
- Commencement No. 9 Regulations 2026 (SI 2026/1015): legislation.gov.uk
- DSIT, Data (Use and Access) Act 2025: plans for commencement: gov.uk
- ICO, The lawful basis for web scraping to train generative AI models: ico.org.uk
- DSIT, DCMS and IPO, Report and impact assessment on copyright and artificial intelligence (18 March 2026): gov.uk
- European Commission, renewal of the UK adequacy decisions (19 December 2025): ec.europa.eu