The short version
| Change | In force | What to do |
|---|---|---|
| When the one-month clock starts (new Article 12A UK GDPR) | 5 February 2026 | Start the clock at the latest of receipt, identity evidence or fee |
| Stopping the clock for clarification | 5 February 2026 | Record when you asked and when they replied |
| Searches need only be reasonable and proportionate | 5 February 2026 | Record where you searched and why that was enough |
| Data protection complaints procedure | 19 June 2026 | Offer an electronic complaint route and acknowledge within 30 days |
The Act received Royal Assent on 19 June 2025 and was brought into force in stages. Most of the data protection changes commenced on 5 February 2026 under SI 2026/82, which also set 19 June 2026 for the complaints duty.
When the clock starts
The one-month time limit is unchanged, but the Act now sets out when it begins: the latest of the day you receive the request, the day you receive any identity information you reasonably asked for, and the day any permitted fee is paid. This puts the ICO's long-standing approach into law.
Stopping the clock
If you reasonably need the requester to clarify the information they want, the clock stops while you wait and restarts when they reply. ICO guidance before the Act limited this to cases where you process a large amount of information about the person. That condition has gone. What has not changed: ask promptly, ask only about the information requested, and do not use clarification to delay.
Reasonable and proportionate searches
The Act confirms you need only make reasonable and proportionate searches. This was already the position in ICO guidance and case law; it is now in the legislation. It does not let you skip systems where the information is likely to be. It does let you explain why searching every backup tape, for example, was not proportionate. The record of what you searched and why is now your main defence, so keep it on every case.
The complaints duty
From 19 June 2026, organisations must have a process for handling data protection complaints. You must:
- make it easy to complain, including by providing an electronic complaint form or similar
- acknowledge a complaint within 30 days of receiving it
- take appropriate steps to respond without undue delay, including making enquiries
- tell the complainant the outcome
For housing associations, a complaint about a late or incomplete subject access response is now also a data protection complaint with its own duties. Make sure your housing complaints process and your data protection complaints process know about each other, so neither clock is missed.
What has not changed
- One calendar month to respond, extendable by two months for complex or numerous requests.
- Subject access is free, unless the request is manifestly unfounded or excessive.
- The exemptions in Schedule 2 to the Data Protection Act 2018, including the third-party provisions.
- The information you must give alongside the copy of the data.
Checklist for your team
- Update your SAR procedure for the new start and stop rules.
- Add fields to your register for "clarification requested" and "clarification received".
- Write down your standard search locations and when you would go further.
- Publish an electronic data protection complaint route and set a 30-day acknowledgement target.
- Brief front-line staff: the change in rules does not change the need to pass requests on the same day.
Not sure where your process stands? Take our two-minute SAR health check.
Questions
Does the Act let us refuse vexatious requests?
No. An earlier bill proposed a "vexatious or excessive" test, but it did not become law. The test remains manifestly unfounded or excessive.
Has the ICO updated its guidance?
The ICO has said its subject access guidance is being reviewed in light of the Act. Check its current pages, and the date on them, before relying on older wording.
Sources
- ICO: Statement on the commencement of the Data (Use and Access) Act
- Data (Use and Access) Act 2025
- The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, SI 2026/82
- ICO: A guide to subject access
This summarises the law and regulator guidance as at 16 October 2026. Take legal advice on a specific request. Spotted something out of date? Tell us and we will fix it.