New Data Protection Regulations: Key Changes You Need to Know

On September 4, 2025, the UK Government introduced new regulations under the Data (Use and Access) Act 2025, further shaping the landscape of data protection with significant implications for legal and national security domains.

What's Happening?

The latest regulations, officially known as the Data (Use and Access) Act 2025 (Commencement No. 3 and Transitional and Saving Provisions) Regulations 2025, bring certain sections of the 2025 Act into force. Here's a breakdown of the key elements:

1. Immediate Changes:

   • Legal Professional Privilege Exemption (Section 79): This section, now in effect, introduces exemptions related to legal professional privilege. It means certain legal communications can be exempt from data requests.
   • National Security Exemption (Section 88): Also effective immediately, this provision allows data processing exemptions where national security is concerned.

2. Upcoming Changes (Effective November 17, 2025):

   • Joint Processing by Intelligence Services (Section 89): This allows intelligence services and other authorities to jointly process information, streamlining data handling in security contexts.
   • Consequential Amendments (Section 90): These are technical adjustments necessary to accommodate the joint processing provisions.

Transitional and Saving Provisions:

These provisions ensure a smooth transition by protecting ongoing processes under the older rules in specific scenarios. For example, if a data request was made before these changes, it will still be handled under the previous regulations.

Why It Matters:

These changes are pivotal for organizations dealing with sensitive information, particularly in legal settings and national security. They balance the need for privacy with practical exemptions where confidentiality and security are paramount.

For those in legal and security sectors, understanding these exemptions is crucial to ensuring compliance and leveraging the benefits they offer.

Looking Ahead:

As these regulations take shape, staying informed about their practical implications will be essential for data controllers, legal professionals, and intelligence agencies. For further details, the full legislative documents and impact assessments are available on the UK Government's website.

Stay Updated:

For ongoing updates and guidance on navigating these changes, keep an eye on official government releases and consult with legal experts specializing in data protection compliance.