The Data (Use and Access) Act 2025 (Commencement No. 2) Regulations 2025
These regulations, enacted under the Data (Use and Access) Act 2025, bring into force section 124 on September 30, 2025.
This section amends the Online Safety Act 2023, requiring providers of certain regulated online services to retain information related to child death investigations.
The regulations are the second set issued under the 2025 Act, and an impact assessment referencing a prior assessment was published on the UK Government website.
Arguments For
Protecting Children: The legislation aims to improve investigations into child deaths by ensuring relevant information is retained by online service providers.
Improved Law Enforcement: Data retention can provide crucial evidence for investigations, potentially leading to more effective prosecutions and safeguarding of children.
Legislative Mandate: The regulations are a direct response to the Data (Use and Access) Act 2025, reflecting a considered legislative process and addressing identified gaps in the law.
Compliance with International Standards: The regulations may align UK law with international best practices in data retention and child protection.
Arguments Against
Privacy Concerns: Mandated data retention could raise concerns about the privacy rights of individuals and the potential for misuse of personal information.
Burden on Service Providers: Compliance with the regulations may impose costs and administrative burdens on internet service providers.
Data Security: Storing large quantities of data raises potential security risks, such as data breaches and hacking.
Overreach of Power: Critics might argue that this expands government access to data and requires further justification or oversight to prevent potential abuse.
- Citation
These Regulations may be cited as the Data (Use and Access) Act 2025 (Commencement No. 2) Regulations 2025.
This section establishes the official short title for these regulations, making it easier to reference them in other documents and legal proceedings.
The title clearly indicates these rules specify the commencement of a part of the Data (Use and Access) Act 2025.
- Commencement
Section 124 of the Data (Use and Access) Act 2025 (retention of information by providers of internet services in connection with death of child) comes into force, so far as not already in force2, on 30th September 2025.
This section specifies the effective date – September 30, 2025 – for section 124 of the Data (Use and Access) Act 2025.
This section relates to data retention by internet service providers in cases involving the death of a child.
The phrase 'so far as not already in force' indicates that parts of the section may have already been enacted.
Explanatory Note (This note is not part of the Regulations)
These Regulations bring into force section 124 of the Data (Use and Access) Act 2025 (c. 18) (“the 2025 Act”). These are the second commencement regulations made under the Act.
Regulation 2 commences section 124 of the 2025 Act which amends the Online Safety Act 2023 (c. 50) (“the 2023 Act”) to include provision in that Act about the retention of information by providers of certain regulated services (for example, social media providers) or any other relevant person in connection with an investigation into the death of a child. ‘Regulated service’ is defined in section 4(4) of the 2023 Act and these provisions apply only in relation to those regulated services that are within section 101(E1) of the 2023 Act (as inserted by section 124 of the 2025 Act). ‘Relevant person’ is defined in section 101(7) of the 2023 Act.
An impact assessment has not been prepared for this instrument as a full impact assessment was published in relation to the provisions in the Data (Use and Access) Bill. Copies can be obtained from the UK Government website at https://www.gov.uk/government/publications/data-use-and-access-bill-supporting-documents or from the Department for Science, Innovation and Technology at 22-26 Whitehall, London, SW1A 2EG, United Kingdom.
The explanatory note provides context and clarifies the regulations' purpose.
It explains that these regulations activate section 124 of the 2025 Act, which alters the 2023 Online Safety Act.
The change mandates data retention by online service providers and relevant individuals during investigations into child deaths.
The note also indicates that a full impact assessment related to the Data (Use and Access) Bill is available online.
NOTE AS TO EARLIER COMMENCEMENT Regulations (This note is not part of the Regulations)
The following provisions of the Data (Use and Access) Act 2025 have been brought into force, so far as they were not already in force (see section 142(2)(h) of that Act), by commencement regulations made before the date of these Regulations.
| Provision | Date of Commencement | S.I. No. | |---|---|---| | Part 1 | 20th August 2025 | 2025/904 | | section 72 (partially) | 20th August 2025 | 2025/904 | | section 74 | 20th August 2025 | 2025/904 | | section 84 | 20th August 2025 | 2025/904 | | section 91 | 20th August 2025 | 2025/904 | | section 92 | 20th August 2025 | 2025/904 | | section 93 | 20th August 2025 | 2025/904 | | section 95 | 20th August 2025 | 2025/904 | | section 102 | 20th August 2025 | 2025/904 | | section 104 | 20th August 2025 | 2025/904 | | section 106 | 20th August 2025 | 2025/904 | | section 107 | 20th August 2025 | 2025/904 | | section 108 | 20th August 2025 | 2025/904 | | section 109 | 20th August 2025 | 2025/904 | | section 110 (partially) | 20th August 2025 | 2025/904 | | section 111 | 20th August 2025 | 2025/904 | | section 113 | 20th August 2025 | 2025/904 | | section 117 (partially) | 20th August 2025 | 2025/904 | | section 125 | 20th August 2025 | 2025/904 | | section 129 | 20th August 2025 | 2025/904 | | section 134 | 20th August 2025 | 2025/904 | | section 135 | 20th August 2025 | 2025/904 | | section 136 | 20th August 2025 | 2025/904 | | section 137 | 20th August 2025 | 2025/904 | | Schedule 11 (partially) | 20th August 2025 | 2025/904 | | Schedule 14 | 20th August 2025 | 2025/904 |
This note lists other sections of the Data (Use and Access) Act 2025 that were brought into force before these regulations, along with their effective dates and Statutory Instrument (S.I.) numbers.
This section shows the legislative history and demonstrates that the present regulations are not the first to implement parts of the Act.