The Data (Use and Access) Act 2025 (Consequential and Other Amendments) Regulations 2025

Published: Wed 17th Dec 25

These Regulations finalize the transition following the enactment of the Data (Use and Access) Act 2025 by making necessary consequential amendments across various pieces of UK legislation.

Key actions include repealing a section of the Data Protection Act 2018 concerning recordable offences while simultaneously updating regulations to ensure the new offence of making false statements in response to an interview notice becomes recordable, and revising numerous electoral and company disclosure rules to align references from the UK GDPR concerning data processing for research and archiving purposes (replacing references to Article 89 with Article 84A).

Arguments For

  • Provides necessary legal alignment by making technical amendments consequential to the new primary legislation, the Data (Use and Access) Act 2025.

  • Incorporates new specific offences under the Data Protection Act 2018 (like making false statements in response to an interview notice) into the list of recordable offences, facilitating police action in these areas.

  • Ensures consistency across various pieces of subordinate legislation related to elections and company disclosures by updating cross-references related to data processing for archiving, research, and statistics purposes (Articles 84A, 84B, and 84C of the UK GDPR).

  • Repeals Section 199(1) of the Data Protection Act 2018, streamlining the legal framework by removing a provision now redundant due to the new Act, although existing recordable offences are preserved through re-listing.

Arguments Against

  • The extensive repeals and amendments to older legislation create complexity in understanding the current statutory landscape regarding data offences and recordability.

  • The broad scope of amendments across numerous electoral and company regulations might face scrutiny regarding proportionality, potentially imposing administrative burdens on bodies responsible for these registers.

  • The retrospective re-listing of offences already considered recordable via the repealed section 199(1) suggests the amendments are primarily technical housekeeping rather than introducing substantive new powers, which might be questioned if efficiency gains are minimal.

  • Amendments concerning the definition of 'Article 89 GDPR purposes' (now 'Article 84A GDPR purposes') in electoral law could lead to transitional confusion if data processing activities were structured around the previous nomenclature immediately before commencement.

The Secretary of State makes these Regulations in exercise of the powers conferred by section 27(4) of the Police and Criminal Evidence Act 1984 , section 199(2) of the Data Protection Act 2018 and section 139(1) and (2)(c) of the Data (Use and Access) Act 2025 .

In accordance with section 182(2) of the Data Protection Act 2018, the Secretary of State has consulted the Commissioner and such other persons as the Secretary of State considers appropriate.

Citation and extent

  1. (1) These Regulations may be cited as the Data (Use and Access) Act 2025 (Consequential and Other Amendments) Regulations 2025.

(2) This regulation and regulation 2 extend to England and Wales, Scotland and Northern Ireland.

(3) An amendment or repeal made by regulations 3 to 18 has the same extent as the provision amended or repealed.

Commencement 2. (1) Regulation 1 and this regulation come into force on the 21st day after the day on which they are laid before Parliament.

(2) Regulations 3, 4, 10, 11, 16 and 17 come into force when section 100 of the Data (Use and Access) Act 2025 comes fully into force.

(3) Regulations 5 to 9, 12 to 15 and 18 come into force when section 86 of the Data (Use and Access) Act 2025 comes fully into force.

Repeal of section 199(1) of the Data Protection Act 2018 3. In the Data Protection Act 2018, in section 199 (recordable offences), omit subsection (1).

Amendment of the National Police Records (Recordable Offences) Regulations 2000 4. In the National Police Records (Recordable Offences) Regulations 2000 , in the Schedule (specified offences), after paragraph 7 insert—

“7A. section 119(6) of the Data Protection Act 2018 (offence of intentionally obstructing, or failing to assist, an inspection of personal data in accordance with international obligations);

7B. section 132(3) of the Data Protection Act 2018 (offence of knowingly or recklessly disclosing information obtained in discharging the Commissioner’s functions);

7C. section 144 of the Data Protection Act 2018 (offence of knowingly or recklessly making a false statement in response to an information notice), except as it is applied by the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016;

7D. section 148(2) of the Data Protection Act 2018 (offence of destroying or falsifying information and documents etc), except as it is applied by the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016;

7E. section 148C of the Data Protection Act 2018 (offence of knowingly or recklessly making a false statement in response to an interview notice) , except as it is applied by the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016;

7F. section 170(1) of the Data Protection Act 2018 (offence of knowingly or recklessly obtaining or disclosing, procuring or retaining personal data without the consent of the controller);

7G. section 170(4) of the Data Protection Act 2018 (offence of selling unlawfully obtained personal data);

7H. section 170(5) of the Data Protection Act 2018 (offence of offering to sell unlawfully obtained personal data);

7I. section 171(1) of the Data Protection Act 2018 (offence of knowingly or recklessly re-identifying de-identified personal data);

7J. section 171(5) of the Data Protection Act 2018 (offence of knowingly or recklessly processing personal data that has been re-identified);

7K. section 173(3) of the Data Protection Act 2018 (offence of altering etc personal data to prevent disclosure to data subject);

7L. section 184(1) of the Data Protection Act 2018 (offence of requiring the production of relevant records in connection with employment or the provision of services);

7M. section 184(2) of the Data Protection Act 2018 (offence of requiring the production of relevant records as a condition of providing goods, facilities or services);

7N. paragraph 15(1) of Schedule 15 to the Data Protection Act 2018 (offence of intentionally obstructing, or failing to assist in, the execution of a warrant), except as it is applied by the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016;

7P. paragraph 15(2) of Schedule 15 to the Data Protection Act 2018 (offence of knowingly or recklessly making a false statement in response to a requirement in the execution of a warrant), except as it is applied by the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016;”.

Amendment of the Representation of the People (England and Wales) Regulations 2001 5. (1) The Representation of the People (England and Wales) Regulations 2001 are amended as follows.

(2) In regulation 3(1) (interpretation), for the definition of “Article 89 GDPR purposes” substitute—

““Article 84A GDPR purposes” means the purposes mentioned in Article 84A(1) of the UK GDPR (archiving in the public interest, scientific or historical research and statistics);”.

(3) In regulation 61A(a) (conditions on the use, supply and inspection of absent voter records or lists), for “Article 89” substitute “Article 84A”.

(4) In regulation 92(2) (interpretation), for sub-paragraph (ba) substitute—

“(ba) “relevant requirement” means the requirement under Article 84B(2) of the UK GDPR, read with Article 84C of the UK GDPR, that personal data processed for Article 84A GDPR purposes must be subject to appropriate safeguards.”.

(5) In regulation 97 (supply of free copy of full register to the British Library and restrictions on use), in paragraphs (5)(b) and (6), for “Article 89” substitute “Article 84A”.

(6) In regulation 97A (supply of free copy of full register to the National Library of Wales and restrictions on use), in paragraphs (7)(b) and (8), for “Article 89” substitute “Article 84A”.

(7) In regulation 99 (supply of free copy of full register etc to Statistics Board and restrictions on use), in paragraphs (6)(b) and (7), for “Article 89” substitute “Article 84A”.

(8) In regulation 109A (supply of full register to public libraries and local authority archives service, and restrictions on use), in paragraphs (9)(b) and (10), for “Article 89” substitute “Article 84A”.

(9) In regulation 119(2)(i) (conditions on the use, supply and disclosure of documents open to public inspection), for “Article 89” substitute “Article 84A”.

Amendment of the Representation of the People (Scotland) Regulations 2001 6. (1) The Representation of the People (Scotland) Regulations 2001 are amended as follows.

(2) In regulation 3(1) (interpretation), for the definition of “Article 89 GDPR purposes” substitute—

““Article 84A GDPR purposes” means the purposes mentioned in Article 84A(1) of the UK GDPR (archiving in the public interest, scientific or historical research and statistics);”.

(3) In regulation 61(3)(a) (absent voters: records and lists kept under Schedule 4), for “Article 89” substitute “Article 84A”.

(4) In regulation 61A(a) (conditions on the use, supply and inspection of absent voter records or lists), for “Article 89” substitute “Article 84A”.

(5) In regulation 92(2) (interpretation), for sub-paragraph (ba) substitute—

“(ba) “relevant requirement” means the requirement under Article 84B(2) of the UK GDPR, read with Article 84C of the UK GDPR, that personal data processed for Article 84A GDPR purposes must be subject to appropriate safeguards.”.

(6) In regulation 96 (supply of free copy of the full register to the National Library of Scotland and the British Library and restrictions on use), in paragraphs (5)(b) and (6), for “Article 89” substitute “Article 84A”.

(7) In regulation 98 (supply of free copy of full register etc to Statistics Board and restrictions on use), in paragraphs (6)(b) and (7), for “Article 89” substitute “Article 84A”.

(8) In regulation 108A (supply of full register to statutory library authorities and local authority archives services, and restrictions on use), in paragraphs (9)(b) and (10), for “Article 89” substitute “Article 84A”.

(9) In regulation 119(2)(i) (conditions on the use, supply and disclosure of documents open to public inspection), for “Article 89” substitute “Article 84A”.

Amendment of the Representation of the People (Absent Voting at Local Government Elections) (Scotland) Regulations 2007 7. In the Representation of the People (Absent Voting at Local Government Elections) (Scotland) Regulations 2007 , in regulation 18(1)(a) (conditions on the supply and inspection of absent voter records or lists), for “Article 89(1)” substitute “Article 84A(1)”.

In the Representation of the People (Absent Voting at Local Government Elections) (Scotland) Regulations 2007, the rule governing the conditions for supplying and inspecting absent voter records or lists is amended. It replaces the reference to "Article 89(1)" with "Article 84A(1)" to reflect the new structure in the UK GDPR relating to processing data for public interest archiving or research.

Amendment of the Representation of the People (Post-Local Government Elections Supply and Inspection of Documents) (Scotland) Regulations 2007 8. In the Representation of the People (Post-Local Government Elections Supply and Inspection of Documents) (Scotland) Regulations 2007 , in regulation 5(2)(i) (conditions on the use, supply and disclosure of documents open to public inspection), for “Article 89(1)” substitute “Article 84A(1)”.

This regulation revises the rules for using, supplying, and disclosing documents open to public inspection after Scottish local government elections. It updates Regulation 5(2)(i) by replacing the reference to Article 89(1) of the GDPR with Article 84A(1) to reflect the necessary consequential changes arising from the Data (Use and Access) Act 2025.

Amendment of the Representation of the People (Northern Ireland) Regulations 2008 9. In the Representation of the People (Northern Ireland) Regulations 2008 , in regulation 118(2) (conditions on the use, supply and disclosure of documents open to public inspection), for “Article 89(1)” substitute “Article 84A(1)”.

This applies to the Northern Ireland elections regulations, specifically concerning the conditions for using, supplying, or disclosing documents that are open for public inspection. Regulation 118(2) is modified to substitute the reference to Article 89(1) with Article 84A(1) of the UK GDPR.

Amendment of the Companies (Disclosure of Address) Regulations 2009 10. In the Companies (Disclosure of Address) Regulations 2009 , in Schedule 2, in Part 2 (disclosure to a credit reference agency), in paragraph 6(1)(c)(iii), after “documents etc)”, insert “or section 148C of that Act (false statements made in response to interview notices)”.

This regulation amends the rules permitting disclosure of company address information to credit reference agencies under the 2009 regulations. It updates paragraph 6(1)(c)(iii) of Schedule 2 to include the new offence detailed in section 148C of the Data Protection Act 2018 (providing false statements during an interview notice process) as a justification for disclosure.

Amendment of the Overseas Companies Regulations 2009 11. In the Overseas Companies Regulations 2009 , in Schedule 2, in Part 2 (disclosure to a credit reference agency), in paragraph 6(1)(c)(iii), after “documents etc)”, insert “or section 148C of that Act (false statements made in response to interview notices)”.

The Overseas Companies Regulations 2009 are similarly updated regarding disclosure to credit reference agencies. Paragraph 6(1)(c)(iii) in Schedule 2 is modified to specifically reference the offence under section 148C of the Data Protection Act 2018 concerning false statements made during interview notices.

Amendment of the Local Elections (Northern Ireland) Order 2010 12. In the Local Elections (Northern Ireland) Order 2010 , in Schedule 3—

(a) in paragraph 1(1) (interpretation), for the definition of “Article 89 GDPR purposes” substitute—

““Article 84A GDPR purposes” means the purposes mentioned in Article 84A(1) of the UK GDPR (archiving in the public interest, scientific or historical research and statistics)”;

(b) in paragraph 5(3) (restrictions on the use, supply and disclosure of documents open to public inspection), for “Article 89” substitute “Article 84A”.

This amends Schedule 3 of the Local Elections (Northern Ireland) Order 2010. Paragraph 1(1) replaces the definition of data processing purposes relating to archiving and research from Article 89 to Article 84A of the UK GDPR. Additionally, paragraph 5(3) is updated by substituting 'Article 89' with 'Article 84A' concerning restrictions on disclosing publicly available election documents.

Amendment of the Police and Crime Commissioner Elections Order 2012 13. (1) The Police and Crime Commissioner Elections Order 2012 is amended as follows.

(2) In Schedule 2—

(a) in paragraph 20(8)(a) (absent voting lists: supply of copies etc), for “Article 89(1)” substitute “Article 84A(1)”;

(b) in paragraph 24(3)(a) (restriction on use of absent voter records or lists or the information contained in them), for “Article 89(1)” substitute “Article 84A(1)”.

(3) In Schedule 10, in paragraph 5(3)(a) (restrictions on the use of documents open to public inspection after an election), for “Article 89(1)” substitute “Article 84A(1)”.

This order concerning Police and Crime Commissioner (PCC) Elections is amended in two schedules. Schedule 2 updates rules regarding the supply and use of absent voting lists, replacing Article 89(1) with Article 84A(1) in paragraphs 20(8)(a) and 24(3)(a).

Schedule 10 also updates restrictions on the use of inspection documents post-election in paragraph 5(3)(a) by making the same substitution regarding the relevant GDPR article.

Amendment of the Neighbourhood Planning (Referendums) Regulations 2012 14. In the Neighbourhood Planning (Referendums) Regulations 2012 , in Schedule 6—

(a) in paragraph 29 (interpretation), in sub-paragraph (1)—

(i) for the definition of “Article 89 GDPR purposes” substitute—

““Article 84A GDPR purposes” means the purposes mentioned in Article 84A(1) of the UK GDPR (archiving in the public interest, scientific or historical research and statistics);”;

(ii) for the definition of “relevant requirement” substitute—

““relevant requirement” means the requirement under Article 84B(2) of the UK GDPR, read with Article 84C of the UK GDPR, that personal data processed for Article 84A GDPR purposes must be subject to appropriate safeguards;”;

(b) in paragraph 33 (supply of copy of business voting register to the British Library and restrictions on use), in sub-paragraphs (6)(b) and (7), for “Article 89” substitute “Article 84A”;

(c) in paragraph 34 (supply of copy of business voting register to the Office for National Statistics and restrictions on use), in sub-paragraphs (6)(b) and (7), for “Article 89” substitute “Article 84A”;

(d) in paragraph 39 (supply of copy of business voting register to public libraries and local authority archives services, and restrictions on use), in sub-paragraphs (8)(b) and (9), for “Article 89” substitute “Article 84A”;

(e) in paragraph 45(2)(a) (conditions on the use, supply and disclosure of documents open to public inspection), for “Article 89” substitute “Article 84A”.

These amendments target Schedule 6 of the Neighbourhood Planning (Referendums) Regulations 2012. Paragraph 29 updates interpretations, replacing 'Article 89 GDPR purposes' with 'Article 84A GDPR purposes' and inserting a new definition for 'relevant requirement' referencing Articles 84B(2) and 84C concerning safeguards.

Rules governing the supply of the business voting register—including its provision to the British Library, the Office for National Statistics, and public libraries—are updated by substituting 'Article 89' with 'Article 84A' in the relevant conditions.

Amendment of the Scottish Parliament (Elections etc.) Order 2015 15. (1) The Scottish Parliament (Elections etc.) Order 2015 is amended as follows.

(2) In Schedule 3—

(a) in paragraph 16(4)(a) (absent voting lists: supply of copies, etc.), for “Article 89(1)” substitute “Article 84A(1)”;

(b) in paragraph 20(3)(a) (conditions on the use, supply and inspection of absent voter lists), for “Article 89(1)” substitute “Article 84A(1)”.

(3) In Schedule 8, in paragraph 5(3)(a) (restriction on use of documents open to public inspection, or of information contained in them), for “Article 89(1)” substitute “Article 84A(1)”.

The Scottish Parliament (Elections etc.) Order 2015 receives amendments in Schedule 3 and Schedule 8. In Schedule 3, paragraphs 16(4)(a) and 20(3)(a) update the rules on supplying and inspecting absent voter lists by replacing Article 89(1) with Article 84A(1) of the UK GDPR.

Schedule 8's provision regarding restrictions on using documents open to public inspection after an election, specifically paragraph 5(3)(a), is also updated with the same substitution.

Amendment of the Companies (Disclosure of Date of Birth Information) Regulations 2015 16. In the Companies (Disclosure of Date of Birth Information) Regulations 2015 , in Schedule 2, in Part 2 (disclosure to a credit reference agency), in paragraph 6(1)(c)(iii), after “documents etc)”, insert “or section 148C of that Act (false statements made in response to interview notices)”.

These Regulations, which govern the disclosure of dates of birth for company directors to credit reference agencies, are modified in Schedule 2, Part 2. Paragraph 6(1)(c)(iii) is amended to include section 148C of the Data Protection Act 2018 (false statements during an interview notice response) as a category of offence allowing disclosure.

Amendment of the Register of People with Significant Control Regulations 2016 17. In the Register of People with Significant Control Regulations 2016 , in Schedule 4, in Part 2 (disclosure to a credit reference agency), in paragraph 6(c)—

(a) omit the “or” after paragraph (iv);

(b) after paragraph (v), insert—

“or

(vi) section 148C of that Act (false statements made in response to interview notices);”.

Amendment of the Senedd Cymru (Representation of the People) Order 2025 18. In the Senedd Cymru (Representation of the People) Order 2025 , in Schedule 1, in paragraph 19(1)(a) (conditions on the use, supply and inspection of absent voter records or lists)—

(a) in the English text version for “article 89(1)” substitute “article 84A(1)”;

(b) in the Welsh text version for “erthygl 89(1)” substitute “erthygl 84A(1)”.

This final regulation concerns the Senedd Cymru (Representation of the People) Order 2025. In Schedule 1, paragraph 19(1)(a), the English text version replaces 'article 89(1)' with 'article 84A(1)'.

The Welsh text version is also updated concurrently, replacing 'erthygl 89(1)' with 'erthygl 84A(1)' in the corresponding provision.