On 19 June 2025, the Data (Use and Access) Bill became the Data (Use and Access) Act 2025 after the Bill received Royal Assent.
A recent article by James Fox and Maddie Howson explored the proposed Bill and the potential impacts on Intellectual Property whilst balancing innovation in developing Artificial Intelligence in the UK. Two months on from the enactment, we discuss what proposals made the cut, which provisions have already come into effect and what we can expect from the newly established Information Commission.
What was the verdict of the legislative ping-pong in relation to copyright and AI?
Well… the government is still assessing options. After a plethora of amendments in the Bill and a long debate between the two Houses, the Act requires that within 9 months of the Act receiving Royal Assent, the Secretary of State must publish an assessment of the economic impact of the four options proposed in the consultation on AI and copyright. The Secretary must also publish a report on the use of copyright works in the development of AI systems and consider the four consultation options.
To recap, the four consultation options for consideration are:
- Leave copyright and related laws as they are. This however means that the current lack of clarity remains for both right holders and AI developers
- Strengthen copyright to require licencing in all cases. This would mean AI models could only be trained on copyright works in the UK if they have an express licence to do so.
- Create a broad data mining exception. This would allow data mining on copyright works, including for AI training, without right holders’ permission.
- Develop a data mining exception which allows IP right holders to reserve their rights, reinforced by supporting measures on transparency.
Although there is no clear-cut guidance as to the impact of AI development on IP rights, the government is considering this point heavily.
Which proposals were passed?
The Act does not have a radical change on data protection legislation, but rather provides clarity in many areas of the UK GDPR and Data Protection Act 2018 (DPA). Such clarifications give scope for organisations to make further innovations and include the following:
- Research: the Act makes it clearer when personal information can be used by organisations for the purposes of scientific research, and commercial scientific research.
- Privacy: the Act removes the requirement for giving privacy notices when re-using personal information for scientific research, where giving a notice would involve a disproportionate effort. This is on the proviso that their rights are protected in other ways and notices describing what is being done are published on websites.
- Recognised Legitimate Interests: the Act allows use of personal information for certain recognised legitimate interests, such as direct marketing, and provides organisations with flexibility to consider the benefits arising from the use of the personal information above the impact on the people whose information is used.
- Assumption of Compatibility: this allows organisations to assume that some instances of re-using personal information are compatible with the original purpose for which it was collected.
Arguably one of the more impactful amendments for both organisations and individuals relates to Subject Access Requests. The Act now makes it explicitly clear that organisations only have to make “reasonable and proportionate” searches when someone asks for access to their personal information. Additionally, organisations are now able to stop the proverbial clock in relation to response time, without missing the all-important deadline. This can be used where they need data subjects to clarify or refine their requests or to provide more information.
When does the Act take effect?
The Act will come into effect in phases, although some parts such as the above mentioned Subject Access Requests came into force on enactment. On 20 August 2025, the following provisions of the Act also came into effect:
- Technical provisions which clarify aspects of the legal framework;
- Establishment of the Information Commission, replacing the Information Commissioner’s Office;
- Provisions that the new Information Commission has enforcement powers including in court proceedings to determine whether a data subject is entitled to information in response to a data subject access request; and
- Requirements of the Information Commission to encourage expert public bodies to develop codes of conduct on the use of personal data for law enforcement purposes.
Has there been any guidance from the ICO?
Information Commission has halted some of their planned guidance in other areas in favour of guidance surrounding the new Act. Their guidance includes codes of practice, checklists, toolkits and position papers. Understandably, it is not an overnight job to issue guidance where there are stages of drafting, consultation, redrafting and publishing. Therefore, the ICO suggest the following timeline for the issue of their guidance in relation to, amongst other things, data protection, privacy, and technology:
Autumn 2025:
- Updates to the Codes of Conduct and Certification Guidance
Winter 2025/2026:
- Guidance on the Act’s new lawful basis of “recognised legitimate interests”
- Complaints guidance for organisations
- Updates to the Direct Marketing and Privacy and Electronic Communications Guidance
- Guidance on the use of anonymisation and pseudonymisation for research purposes
- Updates to draft guidance on storage and access technologies
Spring 2026:
- Update to the Research, Archiving and Statistics Provisions
- Automated Decision Making and Profiling Guidance update
Whilst change has not been immediately sprung upon us, it is important to consider the long term impacts of this new legislation and begin planning for changes that may affect you personally or as an organisation. Our trusted commercial lawyers are available to advise you on your current practices and policies and whether any amendments are necessary to these.