Statute to Operating Model: A Readiness Review for the UK Data (Use and Access) Act

The Data (Use and Access) Act 2025 is no longer a horizon-scanning item. As of November 2026, the governance question for UK organisations is less about what the statute says and more about whether they can show, on request, that their records, notices, assessments and workflows have been adjusted. This briefing sets out a readiness review for data governance leads, DPOs and operational owners. It is not legal commentary; it is a practical route to evidence.

Readiness is an evidence exercise

Regulators and auditors rarely begin with intent. They begin with artefacts. A readiness review should therefore test four things for each affected control: is it documented, is it owned, is it current, and can it be retrieved without a scramble? The Act's commencement profile means different provisions will be adopted at different speeds, and organisations should avoid assuming that a single policy refresh proves operational change.

The review should be sponsored by the accountable executive for data protection and coordinated by the data governance function. Its output is not a legal opinion but a dated action log, an owner for each action and a set of evidence references that can be handed to the ICO or an internal audit team.

Refresh the ROPA as a decision record

The record of processing activities is the natural starting point. Review entries for purposes, lawful bases, categories of data and data subjects, recipients, retention periods, international transfers and security measures. Add a governance layer: a decision reference, the business owner, the date of last review, any linked DPIA and a short change history.

For each processing activity affected by the Act, record why the entry remains accurate or what has changed. This prevents the ROPA from becoming a passive inventory. Evidence should include an approved extract, version history and the minutes or sign-off that show who accepted the update.

Privacy notices: precision and version control

Privacy notices should match the ROPA rather than describe an earlier service model. Check wording on lawful bases, automated decision-making, data-sharing, retention and individual rights. Avoid generic phrases that cannot be substantiated by an operational record. Where the Act changes what the organisation may do or how it explains its processing, the notice should be updated and the change should be communicated through the appropriate channel.

Keep an archive of published versions, dates and channels. Evidence can include screenshots, content-management audit logs and a communication plan showing which customer groups were informed and when.

DPIA templates: build in the new questions

The DPIA template should prompt teams to consider automated decision-making, data-sharing, novel technologies and the organisation's basis for processing. A short screening section can help busy product teams decide whether a full assessment is required. The DPO should own template version control and ensure that completed assessments reference the template version used.

Evidence should include the current template, training materials and two or three sample DPIAs that show the new prompts being applied in practice. The samples need not be exhaustive, but they should demonstrate that the assessment is a live decision record, not a compliance attachment added at the end of a project.

Automated decision-making oversight

Inventory automated decision-making use cases, including those embedded in vendor products. For each, identify the business owner, the nature of the decision, the role of human review, the explanation available to individuals and the monitoring in place. The review should test whether the organisation can explain a decision to an individual and show that oversight is happening, not merely described in a policy.

Evidence should include the ADM register, oversight meeting minutes, sample decision logs and any monitoring reports. Where human review is part of the control, the review should confirm that reviewers have the information, authority and time to intervene.

DSARs: workflow capacity, not just policy

Subject-access workflows should be re-tested under realistic volume. Review request intake, identity verification, clock management, search scope, redaction, third-party data and any exemptions or restrictions. Record timeliness and the lessons from complex cases. A policy that promises compliance is weaker evidence than a case log showing how deadlines were met and where delays were escalated.

Evidence should include the case log, timeliness metrics, training records and a sample of redacted responses. The review should also confirm that operational teams know how to recognise a DSAR and where to send it.

Assemble an ICO engagement pack

Keep a single evidence pack for the next regulatory engagement. A sensible minimum includes a ROPA extract, notice archive, DPIA template and samples, ADM register, DSAR metrics, governance minutes and the readiness action log. Assign an owner and a retention period to the pack so that it does not become an ad hoc folder that is rebuilt each time it is needed.

A 90-day readiness sequence

Days 1 to 10: agree scope, owners and evidence standards. Days 11 to 30: refresh the ROPA and privacy notices. Days 31 to 50: update DPIA templates and review ADM use cases. Days 51 to 70: test DSAR workflows and assemble metrics. Days 71 to 90: consolidate the evidence pack, report residual gaps to the board or risk committee and set a review date. The sequence is deliberately modest; the aim is a defensible operating position, not a one-off documentation exercise.