Data (Use and Access) Act 2025 - Subject Access Request Changes

After a considerable period of time being bounced back and forth between the House of Commons and the House of Lords, the Data (Use and Access) Act 2025 finally passed into law at the end of June. The Act makes a number of changes to the UK’s data protection legislation, many of which will come into force over the coming year.

One particular change to the UK GDPR concerning subject access requests, however, came into force immediately. Not only that, but the amendments made by the Act (in section 78) are to be treated as having come into force on 1 January 2024.

The change in question requires data controllers to conduct a reasonable and proportionate search in order to respond to a subject access request. At first, this backdating may seem somewhat alarming, but the change in question essentially codifies pre-existing ICO guidance and case law.

Both the Data Subject Access Request Guidance Notes and the Data Subject Access Request Policy and Procedure have been updated to reflect this change.

New Short Form Subject Access Request Policy

In addition to these updates, a new Short Form Subject Access Request Policy for Employees is now available. This document is designed for use as an internal employee-facing document, setting out the right of access under the UK GDPR and explaining how employees can make a subject access request to find out what personal data you are holding about them and how you are processing it.