Victims and Prisoners Act 2024 and Data (Use and Access) Act 2025 Commencement Regulations 2026

UK New Legislation

Published March 18th, 2026

Detected March 20th, 2026

Summary

The UK Secretary of State has issued regulations bringing into force specific provisions of the Victims and Prisoners Act 2024 and the Data (Use and Access) Act 2025. These regulations, effective March 31, 2026, introduce a new ground for the right to erasure of personal data under the UK GDPR, specifically for data processed due to malicious allegations.

View original document View source feed page

What changed

These regulations, made by the Secretary of State on March 18, 2026, bring into force Section 31 of the Victims and Prisoners Act 2024 and Paragraph 32 of Schedule 11 to the Data (Use and Access) Act 2025, effective March 31, 2026. Section 31 of the 2024 Act amends Article 17 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It introduces a new ground (Article 17(1)(g)) for the right to erasure of personal data where it has been processed as a result of an allegation made by a malicious person, which has been investigated and found to warrant no further action. The regulations also define 'malicious person' in this context, including those convicted of stalking or harassment offenses or subject to a stalking protection order.

Organizations processing personal data must be aware of this new ground for the right to erasure. Compliance officers should review their data processing activities and policies to ensure they can identify and action erasure requests related to malicious allegations as defined. This change impacts how personal data related to allegations, investigations, and their outcomes must be managed, particularly concerning the 'right to be forgotten' under UK data protection law. The effective date for compliance is March 31, 2026.

What to do next

Review data processing policies for compliance with new UK GDPR Article 17(1)(g)
Implement procedures to identify and process erasure requests related to malicious allegations
Train staff on the definition of 'malicious person' and its implications for data erasure

Source document (simplified)

Status:

This is the original version (as it was originally made). This item of legislation is currently only available in its original format.

Statutory Instruments

2026 No. 317 (C. 25)

DATA PROTECTION

RIGHTS OF DATA SUBJECTS

The Victims and Prisoners Act 2024 (Commencement No. 10) and Data (Use and Access) Act 2025 (Commencement No. 8) Regulations 2026

Made

18th March 2026

The Secretary of State makes these Regulations in exercise of the powers conferred by section 81(2) of the Victims and Prisoners Act 2024(1) and section 142(1) of the Data (Use and Access) Act 2025(2).

Citation, extent and interpretation

—(1) These Regulations may be cited as the Victims and Prisoners Act 2024 (Commencement No. 10) and Data (Use and Access) Act 2025 (Commencement No. 8) Regulations 2026.

(2) These Regulations extend to England and Wales, Scotland and Northern Ireland.

(3) In these Regulations—

“ the 2024 Act ” means the Victims and Prisoners Act 2024;

“ the 2025 Act ” means the Data (Use and Access) Act 2025.

Provision of the 2024 Act coming into force on 31st March 2026

Section 31 (right to erasure of personal data in the UK) of the 2024 Act comes into force on 31st March 2026.

Provision of the 2025 Act coming into force on 31st March 2026

Paragraph 32 of Schedule 11 (Victims and Prisoners Act 2024) to the 2025 Act comes into force on 31st March 2026.

Signed by authority of the Secretary of State

Alex Davies-Jones

Parliamentary Under Secretary of State

Ministry of Justice

18th March 2026

Explanatory Note

(This note is not part of the Regulations)

These Regulations bring into force specified provisions of the Victims and Prisoners Act 2024 (c. 21) (“ the 2024 Act ”) and the Data (Use and Access) Act 2025 (c. 18) (“ the 2025 Act ”) on 31st March 2026. These are the tenth commencement Regulations made under the 2024 Act and the eighth commencement Regulations made under the 2025 Act.

Regulation 2 brings into force section 31 of the 2024 Act. Section 31 makes amendments to Article 17 of Regulation (EU) 2016/679 of the European Parliament, known as the UK General Data Protection Regulation (“UK GDPR”), and the Data Protection Act 2018. Article 17 of the UK GDPR (‘right to erasure’) provides for the circumstances in which data subjects have a right to have personal data erased. The right to erasure is not absolute and does not apply if processing is necessary for one of the reasons specified in Article 17(3), including where processing is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority.

Section 31(2) of the 2024 Act adds a new ground to Article 17(1) of the UK GDPR, Article 17(1)(g), which provides that data subjects have the right to have their personal data erased where it has been processed as a result of an allegation about the data subject that meets the criteria specified in Article 17(1)(g). This provides that the allegation must have been made by a person who is a malicious person in relation to the data subject, have been investigated by the data controller and the controller must have decided that no further action is to be taken in relation to the allegation. Section 31(3) of the 2024 Act amends Article 17 to insert additional paragraphs that provide a definition of a “ malicious person ” for the purposes of Article 17(1)(g). A “malicious person” is someone who: (a) has been convicted of an offence of stalking or harassment (including breach of a stalking protection order) in relation to the data subject (the victim of that offence); or (b) is subject to a stalking protection order made to protect the data subject from a risk associated with stalking. These changes mean that victims of stalking and harassment can request erasure of their personal data when that data has been processed as a result of an unfounded allegation made by their perpetrator.

Regulation 3 brings into force paragraph 32 of Schedule 11 to the 2025 Act. Paragraph 32 ensures that the amendments made by section 31 of the 2024 Act extend to the United Kingdom to align with the extent of the UK GDPR itself.

A full impact assessment has not been produced for this instrument as no, or no significant, impact on the private, voluntary or public sector is foreseen.

NOTE AS TO EARLIER COMMENCEMENT REGULATIONS

(This note is not part of the Regulations)

The following provisions of the Victims and Prisoners Act 2024 have been brought into force by commencement regulations made before the date of these Regulations.

| Provision | Date of Commencement | S.I. No. |
| --- | --- | --- |
| Section 68 | 17th June 2024 | 2024/755 |
| Section 75 (partially) | 2nd August 2024 | 2024/846 |
| Section 76 (partially) | 2nd August 2024 | 2024/846 |
| Section 34 (partially) | 18th September 2024 | 2024/966 |
| Section 36 (partially) | 18th September 2024 | 2024/966 |
| Section 37 | 18th September 2024 | 2024/966 |
| Section 38 | 18th September 2024 | 2024/966 |
| Section 39 | 18th September 2024 | 2024/966 |
| Section 40 (partially) | 18th September 2024 | 2024/966 |
| Section 41 (partially) | 18th September 2024 | 2024/966 |
| Section 42 (partially) | 18th September 2024 | 2024/966 |
| Section 43 (partially) | 18th September 2024 | 2024/966 |
| Section 44 | 18th September 2024 | 2024/966 |
| Section 45 | 18th September 2024 | 2024/966 |
| Section 47 | 18th September 2024 | 2024/966 |
| Section 66 (partially) | 1st November 2024 | 2024/966 |
| Section 67 | 1st November 2024 | 2024/966 |
| Section 1 | 29th January 2025 | 2025/95 |
| Section 2 (partially) | 29th January 2025 | 2025/95 |
| Section 5 | 29th January 2025 | 2025/95 |
| Section 22 (partially) | 29th January 2025 | 2025/95 |
| Section 23 (partially) | 29th January 2025 | 2025/95 |
| Section 24 (partially) | 29th January 2025 | 2025/95 |
| Section 25 (partially) | 29th January 2025 | 2025/95 |
| Section 26 (partially) | 29th January 2025 | 2025/95 |
| Section 27 | 29th January 2025 | 2025/95 |
| Section 66 (remainder) | 1st February 2025 | 2024/966 |
| Section 58 (partially) | 3rd February 2025 | 2025/95 |
| Section 59 (partially) | 3rd February 2025 | 2025/95 |
| Section 65 | 3rd February 2025 | 2025/95 |
| Section 74 | 3rd February 2025 | 2025/95 |
| Section 60 (partially) | 3rd April 2025 | 2025/441 |
| Schedule 2 | 3rd April 2025 | 2025/441 |
| Section 16 | 9th May 2025 | 2025/441 |
| Section 75 (remainder) | 27th May 2025 | 2025/441 |
| Section 76 (remainder) | 27th May 2025 | 2025/441 |
| Section 17 (partially) | 1st June 2025 | 2025/616 |
| Section 17 (remainder) | 1st October 2025 | 2025/616 |
| Section 21 | 25th June 2025 | 2025/731 |
| Section 34 (remainder) | 25th June 2025 | 2025/731 |
| Section 35 | 25th June 2025 | 2025/731 |
| Section 36 (remainder) | 25th June 2025 | 2025/731 |
| Section 40 (remainder) | 25th June 2025 | 2025/731 |
| Section 41 (remainder) | 25th June 2025 | 2025/731 |
| Section 42 (remainder) | 25th June 2025 | 2025/731 |
| Section 43 (remainder) | 25th June 2025 | 2025/731 |
| Section 20 (partially) | 7th November 2025 | 2025/1168 |
| Section 23 (remainder) | 31st December 2025 | 2025/1325 |
| Section 24 (remainder) | 31st December 2025 | 2025/1325 |
| Section 25 (remainder) | 31st December 2025 | 2025/1325 |
| Section 26 (remainder) | 31st December 2025 | 2025/1325 |
| Section 61 | 31st December 2025 | 2025/1325 |
| Section 62 | 31st December 2025 | 2025/1325 |
| Section 63 | 31st December 2025 | 2025/1325 |
| Section 64 | 31st December 2025 | 2025/1325 |
| Section 28 | 12th January 2026 | 2025/1168 |
| Section 29 | 12th January 2026 | 2025/1168 |
| Section 30 | 12th January 2026 | 2025/1168 |
The following provisions of the Data (Use and Access) Act 2025 have been brought into force by commencement regulations made before the date of these Regulations.

| Provision | Date of Commencement | S.I. No. |
| --- | --- | --- |
| Part 1 | 20th August 2025 | 2025/904 |
| Section 72 (partially) | 20th August 2025 | 2025/904 |
| Section 74 | 20th August 2025 | 2025/904 |
| Section 84 | 20th August 2025 | 2025/904 |
| Section 91 | 20th August 2025 | 2025/904 |
| Section 92 | 20th August 2025 | 2025/904 |
| Section 93 | 20th August 2025 | 2025/904 |
| Section 95 | 20th August 2025 | 2025/904 |
| Section 102 | 20th August 2025 | 2025/904 |
| Section 104 | 20th August 2025 | 2025/904 |
| Section 106 | 20th August 2025 | 2025/904 |
| Section 107 | 20th August 2025 | 2025/904 |
| Section 108 | 20th August 2025 | 2025/904 |
| Section 109 | 20th August 2025 | 2025/904 |
| Section 110 (partially) | 20th August 2025 | 2025/904 |
| Section 111 | 20th August 2025 | 2025/904 |
| Section 113 | 20th August 2025 | 2025/904 |
| Section 117 (partially) | 20th August 2025 | 2025/904 |
| Section 125 | 20th August 2025 | 2025/904 |
| Section 129 | 20th August 2025 | 2025/904 |
| Section 134 | 20th August 2025 | 2025/904 |
| Section 135 | 20th August 2025 | 2025/904 |
| Section 136 | 20th August 2025 | 2025/904 |
| Section 137 | 20th August 2025 | 2025/904 |
| Schedule 11 (partially) | 20th August 2025 | 2025/904 |
| Schedule 14 | 20th August 2025 | 2025/904 |
| Section 79 | 5th September 2025 | 2025/996 |
| Section 88 | 5th September 2025 | 2025/996 |
| Section 124 | 30th September 2025 | 2025/982 |
| Section 89 | 17th November 2025 | 2025/996 |
| Section 90 | 17th November 2025 | 2025/996 |
| Part 2 (partially) | 1st December 2025 | 2025/1213 |
| Section 67 | 5th February 2026 | 2026/82 |
| Section 68 | 5th February 2026 | 2026/82 |
| Section 70 | 5th February 2026 | 2026/82 |
| Section 71 | 5th February 2026 | 2026/82 |
| Section 72 (remainder) | 5th February 2026 | 2026/82 |
| Section 73 | 5th February 2026 | 2026/82 |
| Section 75 | 5th February 2026 | 2026/82 |
| Section 76 | 5th February 2026 | 2026/82 |
| Section 77 | 5th February 2026 | 2026/82 |
| Section 80 | 5th February 2026 | 2026/82 |
| Section 81 | 5th February 2026 | 2026/82 |
| Section 83 | 5th February 2026 | 2026/82 |
| Section 85 | 5th February 2026 | 2026/82 |
| Section 86 | 5th February 2026 | 2026/82 |
| Section 87 | 5th February 2026 | 2026/82 |
| Section 94 | 5th February 2026 | 2026/82 |
| Section 98 | 5th February 2026 | 2026/82 |
| Section 99 | 5th February 2026 | 2026/82 |
| Section 100 | 5th February 2026 | 2026/82 |
| Section 101 | 5th February 2026 | 2026/82 |
| Section 105 | 5th February 2026 | 2026/82 |
| Section 110 (remainder) | 5th February 2026 | 2026/82 |
| Section 112 | 5th February 2026 | 2026/82 |
| Section 114 | 5th February 2026 | 2026/82 |
| Section 115 | 5th February 2026 | 2026/82 |
| Section 116 | 5th February 2026 | 2026/82 |
| Section 120 | 5th February 2026 | 2026/82 |
| Section 121 | 5th February 2026 | 2026/82 |
| Section 130 | 5th February 2026 | 2026/82 |
| Section 132 | 5th February 2026 | 2026/82 |
| Section 133 (partially) | 5th February 2026 | 2026/82 |
| Schedule 4 | 5th February 2026 | 2026/82 |
| Schedule 5 | 5th February 2026 | 2026/82 |
| Schedule 6 | 5th February 2026 | 2026/82 |
| Schedule 7 | 5th February 2026 | 2026/82 |
| Schedule 8 | 5th February 2026 | 2026/82 |
| Schedule 9 | 5th February 2026 | 2026/82 |
| Schedule 11 (partially) | 5th February 2026 | 2026/82 |
| Schedule 12 | 5th February 2026 | 2026/82 |
| Schedule 13 | 5th February 2026 | 2026/82 |
| Schedule 15 | 5th February 2026 | 2026/82 |
| Section 138 | 6th February 2026 | 2026/31 |
| Section 123 | 12th February 2026 | 2026/126 |
| Section 103 | 19th June 2026 | 2026/82 |
| Schedule 10 | 19th June 2026 | 2026/82 |
(1) 2024 c. 21.

(2) 2025 c. 18.

Previous
Next Back to top

Named provisions

Citation, extent and interpretation Provision of the 2024 Act coming into force on 31st March 2026 Provision of the 2025 Act coming into force on 31st March 2026