2 Provisions of the 2025 Act coming into force on 5th February 2026

The following provisions of the 2025 Act, so far as not already in force, come into force on 5th February 2026—

(a) section 67 (meaning of research and statistical purposes);

(b) section 68 (consent to processing for the purposes of scientific research);

(c) section 70 (lawfulness of processing);

(d) section 71 (the purpose limitation);

(e) section 72 (processing in reliance on relevant international law);

(f) section 73 (elected representatives responding to requests);

(g) section 75 (fees and reasons for responses to data subjects’ requests about law enforcement processing);

(h) section 76 (time limits for responding to data subjects’ requests);

(i) section 77 (information to be provided to data subjects);

(j) section 80 (automated decision-making);

(k) section 81 (data protection by design: children’s higher protection matters);

(l) section 83 (general processing and codes of conduct);

(m) section 85 (transfers of personal data to third countries and international organisations);

(n) section 86 (safeguards for processing for research etc purposes);

(o) section 87 (section 86: consequential provision);

(p) section 94 (manifestly unfounded or excessive requests to the Commissioner);

(q) section 98 (power of the Commissioner to require a report);

(r) section 99 (assessment notices: removal of OFSTED restriction);

(s) section 100 (interview notices);

(t) section 101 (penalty notices);

(u) section 105 (consequential amendments to the EITSET Regulations);

(v) section 110 (interpretation of the PEC Regulations);

(w) section 112 (storing information in the terminal equipment of a subscriber or user);

(x) section 114 (use of electronic mail for direct marketing by charities);

(y) section 115 (Commissioner’s enforcement powers);

(z) section 116 (codes of conduct);

(z1) section 120 (transfer of property etc to the Information Commission);

(z2) section 121 (information standards for health and adult social care in England);

(z3) section 130 (recognition of EU conformity assessment bodies);

(z4) section 132 (recognition of overseas trust products);

(z5) subsection (4) of section 133 (co-operation between supervisory authority and overseas authorities);

(z6) Schedule 4 (lawfulness of processing: recognised legitimate interests);

(z7) Schedule 5 (purpose limitation: processing to be treated as compatible with original purpose);

(z8) Schedule 6 (automated decision-making: minor and consequential amendments);

(z9) Schedule 7 (transfers of personal data to third countries etc: general processing);

(z10) Schedule 8 (transfers of personal data to third countries etc: law enforcement processing);

(z11) Schedule 9 (transfers of personal data to third countries etc: minor and consequential amendments and transitional provision);

(z12) Schedule 11 (further minor provision about data protection), except paragraph 32;

(z13) Schedule 12 (storing information in the terminal equipment of a subscriber or user);

(z14) Schedule 13 (privacy and electronic communications: Commissioner’s enforcement powers);

(z15) Schedule 15 (information standards for health and adult social care in England).