Guides › Data protection and the Data (Use and Access) Act
Data protection and the Data (Use and Access) Act: what it means for health tech start-ups
What are the data protection rules for UK healthtech?
Updated 6 November 2026 from public records. 12 items below.
At a glance
- 12 records from the last 120 days, 8 naming health tech directly
- Next consultation closes 8 January 2027
- Latest record: 6 November 2026
The Data (Use and Access) Act 2025 changed parts of UK data protection law and gave government powers to set up "smart data" schemes that let customers share their data with other firms, following open banking. Most of it has applied since 5 February 2026. The Information Commission, which replaced the Information Commissioner's Office on 30 September 2026, is still publishing guidance on it. The Act on legislation.gov.uk.
What it means for your start-up
Health data is special category data under UK data protection law, so it needs a stronger legal basis and tighter safeguards than other personal data. Selling to the NHS adds the Data Security and Protection Toolkit and the NHS's own rules on data sharing. Since 5 February 2026 the Data (Use and Access) Act has changed parts of the law, including the rules on research and automated decisions.
What to do now
- Complete a data protection impact assessment for any new use of health data, before you start.
- Complete the NHS Data Security and Protection Toolkit if you handle NHS patient data.
- Follow the Information Commission's (formerly the ICO's) guidance under the Data (Use and Access) Act, especially on research.
Open for comment now
- Energy smart data legislative framework
We are consulting on the design and implementation of an energy smart data legislative framework.
Latest from government
- Periods of Data and Market Exclusivity for UK Reference Medicinal Products
UK reference medicinal products authorised in the period 2014 – 2021 and their associated dates of expiry of data protection, marketing exclusivity. - Tech Town Business Survey: privacy notice 2026 to 2027
How the Department for Science, Innovation and Technology (DSIT) uses personal data collected through the Tech Town business survey. - Privacy notice for applicants to be UK nominee for the UN CEDAW committee
A privacy notice which sets out your rights and how we will use your personal data.
In Parliament
Marked: mentions health tech directly.
- (a) whether her Department has assessed the risk that allowing individual GP practices discretion over the scope of proxy access granted to parents and…
Asked by Liz Jarvis (LD). General Practitioners: Data Protection — There is guidance from NHS England for GP practices on using GP electronic records which cover arrangements for young people, and which is available… - What measures are in place to ensure that NHS data, including children's heath records, are held and processed under UK control.
Asked by Baroness Benjamin (LD). NHS: Data Protection — Patient data in the United Kingdom remains covered by the legal frameworks set out in the Data Protection Act 2018, and the Common Law Duty of Confidentiality,… - How many medical staff have been sacked for accessing patient records in a) 2025 and b) 2026.
Asked by Ben Obese-Jecty (Con). Medical Records: Data Protection — The requested information is not centrally held. - What assessment she has made of potential levels of the exposure of NHS systems holding patient data to the harvest-now-decrypt-later risk; and what the…
Asked by Dr Ben Spencer (Con). Health Services: Data Protection — The Department and NHS England have established processes for assessing, identifying, and mitigating emerging threats, and use mechanisms such as the… - What recent steps her Department has taken to safeguard against the potential misuse of patient data shared with third-party organisations.
Asked by Mr Tanmanjeet Singh Dhesi (Lab). Medical Records: Data Protection - What assessment she has made of the risk of autonomous AI agents gaining unauthorised access to NHS systems holding patient or operational data; and whether…
Asked by Mrs Sharon Hodgson (Lab). NHS: Data Protection — NHS England and the Department recognise the emerging cyber security risks associated with increasingly capable and autonomous artificial intelligence (AI)… - What barriers have been identified to effective data sharing between primary care providers and Integrated Care Boards; and what steps her Department is taking…
Asked by David Taylor (Lab). Health Services: Information Sharing — The Government is taking forward digital services to help improve the sharing of patient data, which have the improvement of care and the… - What steps she is taking to ensure that NHS data remains under UK control and is used for the benefit of UK patients.
Asked by Mrs Sharon Hodgson (Lab). Health Services: Data Protection — Patient data in the United Kingdom remains covered by the legal frameworks set out in the Data Protection Act 2018, and the Common Law Duty of…
Want this for your own company? Seam tracks what government, Parliament and the regulators are doing and tells you only what affects your business, as it happens.
Related guides
- How is AI in healthcare regulated in the UK?
- What the Data (Use and Access) Act changes for software firms
- How do healthtech start-ups sell to the NHS?
- How are medical devices regulated in the UK?
Contains public sector information licensed under the Open Government Licence v3.0. Contains Parliamentary information licensed under the Open Parliament Licence v3.0. General information, not legal advice.