Guides › Data protection and the Data (Use and Access) Act
Data protection and the Data (Use and Access) Act: what it means for software and AI start-ups
What the Data (Use and Access) Act changes for software firms
Updated 6 November 2026 from public records. 12 items below.
At a glance
- 12 records from the last 120 days, 7 naming software and AI directly
- Next consultation closes 8 January 2027
- Latest record: 6 November 2026
The Data (Use and Access) Act 2025 changed parts of UK data protection law and gave government powers to set up "smart data" schemes that let customers share their data with other firms, following open banking. Most of it has applied since 5 February 2026. The Information Commission, which replaced the Information Commissioner's Office on 30 September 2026, is still publishing guidance on it. The Act on legislation.gov.uk.
What it means for your start-up
The Act eases some data protection rules: it adds a list of recognised legitimate interests, relaxes the limits on automated decision-making with safeguards, and allows some cookies without consent. These changes have applied since 5 February 2026, and the Information Commission, which replaced the ICO in September 2026, is still updating its guidance on them.
What to do now
- Review your cookie banner and consent flows against the exemptions that have applied since 5 February 2026.
- Check any automated decisions your product makes against the new safeguards.
- Follow the Information Commission's (formerly the ICO's) guidance updates. They turn the Act into what you actually have to do.
Open for comment now
- Energy smart data legislative framework
We are consulting on the design and implementation of an energy smart data legislative framework.
Latest from government
- Periods of Data and Market Exclusivity for UK Reference Medicinal Products
UK reference medicinal products authorised in the period 2014 – 2021 and their associated dates of expiry of data protection, marketing exclusivity. - Tech Town Business Survey: privacy notice 2026 to 2027
How the Department for Science, Innovation and Technology (DSIT) uses personal data collected through the Tech Town business survey. - Privacy notice for applicants to be UK nominee for the UN CEDAW committee
A privacy notice which sets out your rights and how we will use your personal data.
In Parliament
Marked: mentions software and ai directly.
- What assessment she has made of the potential implications for her policies of reports that AI developers are investigating tens of thousands of security…
Asked by Mrs Sharon Hodgson (Lab). Artificial Intelligence: Data Protection — I refer the Rt. Hon Member to my speech delivered on 12 October 2026, which outlined the action the Government is taking in response to… - What arrangements exist for them to be notified of any request made by the government of the USA to a US-based cloud provider to produce data held on behalf of…
Asked by Lord Clement-Jones (LD). Police: Data Protection — The UK-US Data Access Agreement (DAA) applies only to cross-border requests between the UK and the US. It enables law enforcement and security agencies to… - Which body an AI developer should notify of an incident in which an AI system affects an organisation in the UK.
Asked by Dr Ben Spencer (Con). Artificial Intelligence: Safety — The appropriate reporting route depends on the nature of the incident. For example, incidents involving personal data may need to be reported to the… - What statutory safety obligations apply to frontier AI developers operating in the UK.
Asked by Bell Ribeiro-Addy (Lab). Artificial Intelligence: Regulation — AI is already regulated in the UK through existing laws and regulators, covering data protection, competition, product safety, and online… - What discussions her Department has had with the Information Commission on the sharing of connected vehicle data with advertising technology firms and data…
Asked by Iqbal Mohamed (Ind). Digital Technology: Motor Vehicles — The Department has had conversations with the ICO about Connected Vehicle data as part of the Government’s ongoing work to better understand what… - Personal Data (Digital Twins)
Motion for leave to bring in a Bill (Standing Order No. 23) I beg to move, That leave be given to bring in a Bill to make provision about the regulation of software or algorithms which use or hold personal data for… - Whether her Department has carried out an impact assessment into the a) risk and b) impact on UK based individuals of data breaches of technology firms who…
Asked by Ruth Cadbury (Lab). Age Assurance: Data Protection — The UK’s data protection legislation applies to organisations that process personal data, including age assurance services. The legislation requires… - What information and specific datasets the Land Registry licences to HMRC Valuation Office for council tax valuation work; and whether this includes data from…
Asked by David Simmonds (Con). Council Tax: Valuation — As part of a confidential data sharing agreement, HM Land Registry shares Title Register information, including data from the National Polygon Service, with HM…
Want this for your own company? Seam tracks what government, Parliament and the regulators are doing and tells you only what affects your business, as it happens.
Related guides
- What do the CMA's digital markets rules mean for software?
- Is there a UK AI law my software start-up must follow?
- Is my software platform in scope of the Online Safety Act?
- What are the data protection rules for UK healthtech?
Contains public sector information licensed under the Open Government Licence v3.0. Contains Parliamentary information licensed under the Open Parliament Licence v3.0. General information, not legal advice.