The Data (Use and Access) Act 2025: What Changes for Subject Access Requests

The headline change: "stop the clock" is now law

The Data (Use and Access) Act 2025 received Royal Assent on 17 June 2025. For Subject Access Requests, its most relevant change is codifying a “stop the clock” rule: when a business needs to verify a requester's identity, or needs the requester to clarify what they're actually asking for, the one-month response deadline pauses until that information arrives.

This isn't actually new practice — it's a new legal footing

The ICO had already guided businesses that they could pause the clock in these circumstances. What the Act does is move that from guidance into statute, giving it firmer legal standing. If your process already follows ICO guidance on this, the practical day-to-day change is small — but it's now backed by law rather than guidance alone.

Where the limit is

The pause only applies where a business genuinely cannot reasonably proceed without the missing information. It isn't a general-purpose way to buy time, and using it as a routine delaying tactic is exactly the kind of pattern that leads to an ICO complaint — the same complaint category this Act's clock-pausing rule was designed to clarify, not create loopholes in.

What hasn't changed

• The core deadline is still one calendar month from receipt (or from identity confirmation, if needed first).
• The complex-request extension (up to two further months) is unaffected.
• Weekend/bank-holiday roll-forward still applies the same way.

When does it actually take effect?

Royal Assent isn't the same as being in force. The Act's provisions commence in phases through separate commencement regulations, not all on the date it was signed into law. Check the current commencement status (or confirm with a solicitor) before treating any specific date as settled — this is genuinely one of those details worth verifying directly rather than assuming from a blog post, including this one.

How DataDeadline handles this

DataDeadline's deadline engine already supports pausing and resuming the clock for exactly this scenario — stop-the-clock extensions were built in before this Act existed, based on the same ICO guidance it now codifies. If you're tracking SARs by hand, this is one more rule to remember correctly on every request; the free SAR deadline calculator and a free DataDeadline account both handle it automatically.