Data (Use and Access) Act: Subject Access Changes

The Data (Use and Access) Act 2025 didn’t rewrite the right of access. It put three things on a clearer legal footing: searches only need to be reasonable and proportionate, the clock can pause while you wait for information you genuinely need, and people can now complain to you directly. The one-month time limit and most other rules stay the same.

The Data (Use and Access) Act 2025 (DUAA) received Royal Assent on 19 June 2025, and its changes to UK data protection law have come into force in stages since then. For subject access requests, the changes are practical rather than dramatic.

Here’s what’s new for UK organisations, and what has stayed the same.

Why did the law change?

The DUAA amends UK GDPR and the Data Protection Act 2018. On subject access, most of the changes write existing ICO guidance into law, so organisations have more certainty about what’s expected of them.

The Act also adds one genuinely new duty: a formal process for data protection complaints.

Time limits and pausing the clock (Article 12A)

Since 5 February 2026, the time limits for responding sit in a new Article 12A of UK GDPR. The basics are unchanged:

You have one month to respond.

You can extend by up to two more months if a request is complex, or if the person has made a number of requests.

You must tell the person about an extension, with the reasons, within the first month.

What’s clearer is when the clock starts and pauses. The month runs from the latest of three points: when you receive the request, when you receive any information you need to confirm who the person is, or when any fee you’re allowed to charge is paid.

Article 12A also confirms the “stop the clock” rule. If you reasonably need more information to identify what the person is asking for, you can ask for it, and the time spent waiting doesn’t count. The law gives the example of a controller that holds a large amount of information about the person.

Clarification still can’t be used to make someone narrow their request. If they want everything, you still carry out a proper search.

Reasonable and proportionate searches

Section 78 of the DUAA added a new paragraph to Article 15 of UK GDPR. A person is now entitled to the information you’re able to provide “based on a reasonable and proportionate search”.

The change came into force on Royal Assent, and the Act treats it as having applied from 1 January 2024.

This doesn’t mean searching only where it’s easy. The ICO’s search guidance says to weigh the volume of information, how hard it is to find and the importance of the right of access. If you decide a particular search would be disproportionate, you need to be able to explain why.

In practice, a short written search plan, showing where you looked and why, is the simplest way to show your search was reasonable.

The new right to complain to you first

Since 19 June 2026, people have a legal right to make data protection complaints directly to the organisation. The DUAA added this as section 164A of the Data Protection Act 2018.

Under the ICO’s complaints guidance, organisations must:

give people a way to make data protection complaints

acknowledge each complaint within 30 days

look into it without undue delay and keep the person updated

tell the person the outcome

The ICO will usually ask people to raise a complaint with the organisation first. So a person who is unhappy with how their subject access request was handled is likely to come back to you before going to the regulator. A clear record of how the request was handled makes that much easier to answer.

What hasn’t changed?

Most of the right of access works exactly as before:

The right itself. People can still ask for confirmation that you use their information, a copy of it, and details of how you use it.

No special wording. A request can be made in any form, to anyone in your organisation.

No reason needed. A person’s motive doesn’t affect whether a request is valid.

Free in most cases. A fee is still only allowed for manifestly unfounded or excessive requests, or further copies.

Exemptions. The existing exemptions still apply, item by item.

An earlier proposal to let organisations refuse “vexatious” requests wasn’t carried into the DUAA. The test remains whether a request is manifestly unfounded or excessive.

For the full process, read our step-by-step guide to handling a subject access request, or our closer look at searching, redacting and responding. And if there’s a tricky request on your desk, talk to our team.

FAQs

What did the Data (Use and Access) Act change for subject access requests?

It confirmed in law that searches need to be reasonable and proportionate, set out when the clock can pause, and gave people the right to complain to organisations directly. The one-month time limit stayed the same.

What is “stop the clock” for a subject access request?

Under Article 12A of UK GDPR, if you reasonably need more information to identify what a person is asking for, the time spent waiting for their answer doesn’t count towards the one-month limit.

When did the reasonable and proportionate search rule start?

It came into force when the Act received Royal Assent on 19 June 2025, and is treated as having applied from 1 January 2024.

How long do organisations have to acknowledge a data protection complaint?

30 days. Since 19 June 2026, organisations must also look into complaints without undue delay and tell the person the outcome.

Is the time limit for a subject access request still one month?

Yes. It can be extended by up to two more months for complex requests, as long as the person is told why within the first month.

This article is general information for UK organisations, not legal advice.