Jurisdiction ยท 4 regulationsUnited Kingdom: data, AI and cyber laws
4 regulations in United Kingdom that affect companies handling data: Data (Use and Access) Act, UK Cyber Security and Resilience Bill, UK GDPR, UK Online Safety Act. Part of UK and Europe.
4 regulations
Add to calendar
- Data (Use and Access) Act
United Kingdom
In forcePrivacyData access and sharingNext: Sep 30, 2026 ICO abolished; Information Commission takes over
- UK Cyber Security and Resilience Bill
United Kingdom
ProposedCybersecurityBreach notificationNext: Oct 26, 2026 Lords report stage scheduled
- UK GDPR
United Kingdom
AmendedPrivacyBreach notificationEffective May 25, 2018
- UK Online Safety Act
United Kingdom
In forceOnline safetyChildrenEffective Mar 17, 2025
Upcoming deadlines
September 20261 deadline
ICO abolished; Information Commission takes over
Sections 118-119 commence: office of Information Commissioner abolished and functions transferred to the Information Commission (Commencement No. 9 Regulations 2026).
October 20261 deadline
Lords report stage scheduled
House of Lords report stage scheduled (committee stage sat 1, 3 and 7 Sept 2026).
Past deadlines
June 20262 deadlines
Mandatory data protection complaints procedure
Controllers must have a process for data subject complaints (s.103 and Sch. 10), per Commencement No. 6 Regulations 2026, reg. 3.
Passes House of Commons
Report stage and third reading completed in the Commons after carry-over into the new session.
April 20261 deadline
Fee notification window closes (2026/27)
Fee-liable providers must notify Ofcom before the notification window for the first charging year closes.
February 20262 deadlines
Stage 3: main data protection changes commence
Recognised legitimate interests, ADM reforms, DSAR changes, international transfer test, cookie exemptions and PECR fines at UK GDPR levels apply (Commencement No. 6 Regulations 2026, reg. 2).
November 20251 deadline
Introduced (Commons first reading)
Bill introduced in the House of Commons.
August 20251 deadline
Stage 1 commencement
Technical data protection provisions, ICO statutory objects, Smart Data framework (Part 1) and AI/copyright reporting duties commence (Commencement No. 1 Regulations 2025).
July 20251 deadline
Protection of children duties apply
Children's safety duties and Protection of Children Codes take effect, including highly effective age assurance; children's risk assessments due by 24 July 2025.
June 20251 deadline
Royal Assent
The Act receives Royal Assent; commencement staged by regulations.
April 20251 deadline
Children's access assessments due
Services had to complete children's access assessments to determine whether children are likely to access them.
March 20251 deadline
Illegal harms duties enforceable
Illegal content safety duties apply; illegal content risk assessments had to be completed by 16 March 2025.
October 20231 deadline
Royal Assent
The Online Safety Act receives Royal Assent.