DUA Act 2025
Data (Use and Access) Act 2025
Omnibus data legislation covering customer data access, digital verification services, the Information Commission, and AI-related provisions including copyright/training transparency requirements and new criminal offenses for creating AI-generated intimate images (deepfakes).
Jurisdiction
United Kingdom
Enacted
Jun 19, 2025
Effective
Jun 19, 2025
Enforcement
Crown Prosecution Service (criminal); Information Commission (data provisions)
Royal Assent 19 June 2025
legislation.gov.ukWhy It Matters
Creates criminal liability for AI-generated intimate imagery. The mandated reports on AI training and copyright may lead to future disclosure requirements for AI developers. Primarily relevant for platforms dealing with synthetic media.
Recent Developments
Enacted June 2025. AI/copyright provisions require reports within 9 months but defer substantive regulation. Deepfake intimate image provisions in force immediately.
At a Glance
Applies to
Requires
Who Must Comply
- Anyone creating AI-generated intimate imagery (criminal provisions)
- AI developers using copyrighted training data (future regulation subject to reports)
- Data holders and customer data processors
Safety Provisions
- Creates criminal offense for creating 'purported intimate images' (AI deepfakes) of adults without consent (s.66E SOA 2003)
- Creates criminal offense for requesting creation of such images (s.66F SOA 2003)
- Mandates economic impact assessment on AI training using copyrighted works
- Mandates report on copyright works in AI development including transparency and disclosure requirements
Exemptions
Reasonable Excuse Defense
Defense available for creating purported intimate images if person had reasonable excuse
- • Must prove reasonable excuse for creation
Compliance & Enforcement
Key Dates
Mar 19, 2026
Secretary of State must publish economic impact assessment on AI training and copyright (s.135)
Secretary of State must publish report on use of copyright works in AI development (s.136)
Penalties
criminal (up to 1yr)
View on map
United Kingdom
Focus Areas
Cite This
APA
United Kingdom. (2025). Data (Use and Access) Act 2025.
Related Regulations
UK AI/ADM Code Regs (SI 2026/425)
Statutory instrument requiring the Information Commissioner to prepare a statutory code of practice on processing personal data in artificial intelligence and automated decision-making systems, with specific provision for protecting children's personal data.
UK DPA 2018
The UK's foundational data protection law, incorporating the UK GDPR (retained EU GDPR post-Brexit). Substantively mirrors EU GDPR with ICO as sole enforcer. Article 22 restricts automated decision-making; Article 9 classifies mental health as special category data; children's consent age set at 13. Parent framework for UK Children's Code; amended by DUA Act 2025.
TX TDPSA + SCOPE
Texas AG Paxton is the MOST AGGRESSIVE enforcer against AI companion companies. December 2024 investigations launched against Character.AI, Reddit, Instagram, Discord.
UK OSA CSEA Reporting Regs 2026
Statutory instrument implementing section 69 of the UK Online Safety Act 2023, requiring regulated user-to-user service providers (UK and non-UK) to report child sexual exploitation and abuse (CSEA) content to the National Crime Agency under tiered priority-based timeframes.
UK OSA
One of the most comprehensive platform content moderation regimes globally. Creates specific duties around suicide, self-harm, and eating disorder content for children with 'highly effective' age assurance requirements.
UK AI Approach
Sector-specific, principles-based approach using existing regulators. Five cross-sector principles guide regulatory application rather than horizontal AI legislation.
Last updated January 23, 2026. Verify against primary sources before relying on this information.