Data (Use and Access) Act 2025 in Northern Ireland
2025 c. 18 · Enacted 19 June 2025 · Extends to United Kingdom
An Act to make provision about access to customer data and business data; to make provision about services consisting of the use of information to ascertain and verify facts about individuals; to make provision about the recording and sharing, and keeping of registers, of information relating to apparatus in streets; to make provision about the keeping and maintenance of registers of births and deaths; to make provision for the regulation of the processing of information relating to identified or identifiable living individuals; to make provision about privacy and electronic communications; to establish the Information Commission; to make provision about information standards for health and social care; to make provision about the grant of smart meter communication licences; to make provision about the disclosure of information to improve public service delivery; to make provision about the retention of information by providers of internet services in connection with investigations into child deaths; to make provision about providing information for purposes related to the carrying out of independent research into online safety matters; to make provision about the retention of biometric data; to make provision about services for the provision of electronic signatures, electronic seals and other trust services; to make provision about works protected by copyright and the development of artificial intelligence systems; to make provision about the creation of purported intimate images; and for connected purposes.
[19th June 2025]
Be it enacted by the King’s most Excellent Majesty, by and with the advice and consent of the Lords Spiritual and Temporal, and Commons, in this present Parliament assembled, and by the authority of the same, as follows:—
Contents
- Part 1: Access to customer data and business data
- Introductory
- 1Customer data and business data
- Data regulations
- 2Power to make provision in connection with customer data
- 3Customer data: supplementary
- 4Power to make provision in connection with business data
- 5Business data: supplementary
- 6Decision-makers
- 7Interface bodies
- Enforcement
- 8Enforcement of regulations under this Part
- 9Restrictions on powers of investigation etc
- 10Financial penalties
- Fees etc and financial assistance
- 11Fees
- 12Levy
- 13Financial assistance
- Financial services sector
- 14The FCA and financial services interfaces
- 15The FCA and financial services interfaces: supplementary
- 16The FCA and financial services interfaces: penalties and levies
- 17The FCA and co-ordination with other regulators
- Supplementary
- 18Liability in damages
- 19Duty to review regulations
- 20Restrictions on processing and data protection
- 21Regulations under this Part: supplementary
- 22Regulations under this Part: Parliamentary procedure and consultation
- 23Related subordinate legislation
- 24Repeal of provisions relating to supply of customer data
- 25Other defined terms
- 26Index of defined terms for this Part
- Part 2: Digital verification services
- Introductory
- 27Introductory
- DVS trust framework and supplementary codes
- 28DVS trust framework
- 29Supplementary codes
- 30Withdrawal of a supplementary code
- 31Review of DVS trust framework and supplementary codes
- DVS register
- 32DVS register
- 33Registration in the DVS register
- 34Power to refuse registration in the DVS register
- 35Registration of additional services
- 36Supplementary notes
- 37Addition of services to supplementary notes
- 38Applications for registration, supplementary notes, etc
- 39Fees for applications for registration, supplementary notes, etc
- 40Duty to remove person from the DVS register
- 41Power to remove person from the DVS register
- 42Duty to remove services from the DVS register
- 43Duty to remove supplementary notes from the DVS register
- 44Duty to remove services from supplementary notes
- Information gateway
- 45Power of public authority to disclose information to registered person Not yet in force
- 46Information disclosed by the Revenue and Customs Not yet in force
- 47Information disclosed by the Welsh Revenue Authority Not yet in force
- 48Information disclosed by Revenue Scotland Not yet in force
- 49Code of practice about the disclosure of information
- Trust mark
- 50Trust mark for use by registered persons
- Supplementary
- 51Power of Secretary of State to require information
- 52Arrangements for third party to exercise functions
- 53Report on the operation of this Part
- 54Index of defined terms for this Part
- 55Powers relating to verification of identity or status
- Part 3: National Underground Asset Register
- 57Information in relation to apparatus: England and Wales
- 58National Underground Asset Register: Northern Ireland
- 59Information in relation to apparatus: Northern Ireland
- 60Pre-commencement consultation Not yet in force
- Part 4: Registers of births and deaths
- 65Minor and consequential amendments Not yet in force
- Part 5: Data protection and privacy
- Chapter 1: Data protection
- Terms used in this Chapter
- 66The 2018 Act and the UK GDPR
- Definitions in the UK GDPR and the 2018 Act
- 67Meaning of research and statistical purposes
- 68Consent to processing for the purposes of scientific research
- 69Consent to law enforcement processing
- Data protection principles
- 70Lawfulness of processing
- 71The purpose limitation
- 72Processing in reliance on relevant international law
- Processing of special categories of personal data
- 73Elected representatives responding to requests
- 74Processing of special categories of personal data
- Data subject’s rights
- 75Fees and reasons for responses to data subjects’ requests about law enforcement processing
- 76Time limits for responding to data subjects’ requests
- 77Information to be provided to data subjects
- 78Searches in response to data subjects’ requests
- 79Data subjects’ rights to information: legal professional privilege exemption
- Automated decision-making
- 80Automated decision-making
- Obligations of controllers
- 81Data protection by design: children’s higher protection matters
- Logging of law enforcement processing
- 82Logging of law enforcement processing
- Codes of conduct
- 83General processing and codes of conduct
- 84Law enforcement processing and codes of conduct
- International transfers of personal data
- 85Transfers of personal data to third countries and international organisations
- Safeguards for processing for research etc purposes
- 86Safeguards for processing for research etc purposes
- 87Section 86: consequential provision
- National security
- 88National security exemption
- Intelligence services
- 89Joint processing by intelligence services and competent authorities
- 90Joint processing: consequential amendments
- Information Commission's role
- 91Duties of the Commission in carrying out functions
- 92Codes of practice for the processing of personal data
- 93Codes of practice: panels and impact assessments
- 94Manifestly unfounded or excessive requests to the Commissioner
- 95Analysis of performance
- 96Notices from the Commissioner
- Enforcement
- 97Power of the Commissioner to require documents
- 98Power of the Commissioner to require a report
- 99Assessment notices: removal of OFSTED restriction
- 100Interview notices
- 101Penalty notices
- 102Annual report on regulatory action
- 103Complaints by data subjects
- 104Court procedure in connection with subject access requests
- 105Consequential amendments to the EITSET Regulations
- Protection of prohibitions, restrictions and data subject’s rights
- 106Protection of prohibitions, restrictions and data subject’s rights
- Miscellaneous
- 107Regulations under the UK GDPR
- 108Further minor provision about data protection
- Chapter 2: Privacy and electronic communications
- 109The PEC Regulations
- 110Interpretation of the PEC Regulations
- 111Duty to notify the Commissioner of personal data breach: time periods
- 112Storing information in the terminal equipment of a subscriber or user
- 113Emergency alerts: interpretation of time periods
- 114Use of electronic mail for direct marketing by charities
- 115Commissioner’s enforcement powers
- 116Codes of conduct
- Part 6: The Information Commission
- 117The Information Commission
- 118Abolition of the office of Information Commissioner
- 119Transfer of functions to the Information Commission
- 120Transfer of property etc to the Information Commission
- Part 7: Other provision about use of, or access to, data
- Smart meter communication services
- 122Grant of smart meter communication licences
- Information to improve public service delivery
- 123Disclosure of information to improve public service delivery to undertakings
- Retention of information by providers of internet services
- 124Retention of information by providers of internet services in connection with death of child
- Information for research about online safety matters
- 125Information for research about online safety matters
- Retention of biometric data
- 126Retention of biometric data and recordable offences
- 127Retention of pseudonymised biometric data
- 128Retention of biometric data from INTERPOL
- Trust services
- 129The eIDAS Regulation
- 130Recognition of EU conformity assessment bodies
- 131Removal of recognition of EU standards etc Not yet in force
- 132Recognition of overseas trust products
- 133Co-operation between supervisory authority and overseas authorities
- 134Time periods: the eIDAS Regulation and the EITSET Regulations
- Copyright works and artificial intelligence systems
- 135Economic impact assessment
- 136Report on the use of copyright works in the development of AI systems
- 137Progress statement
- Purported intimate images
- 138Creating, or requesting the creation of, purported intimate image of adult
- Part 8: Final provisions
- 139Power to make consequential amendments
- 140Regulations
- 141Extent
- 142Commencement
- 143Transitional, transitory and saving provision
- 144Short title
- Schedule 2National Underground Asset Register (Northern Ireland): monetary penalties
- Schedule 3: Registers of births and deaths: minor and consequential amendments Not yet in force
- Part 1: Amendments of the Births and Deaths Registration Act 1953 Not yet in force
- 1Paragraph 1 Not yet in force
- 2Paragraph 2 Not yet in force
- 3Paragraph 3 Not yet in force
- 4Paragraph 4 Not yet in force
- 5Paragraph 5 Not yet in force
- 6Paragraph 6 Not yet in force
- 7Paragraph 7 Not yet in force
- 8Paragraph 8 Not yet in force
- 9Paragraph 9 Not yet in force
- 10Paragraph 10 Not yet in force
- 11Paragraph 11 Not yet in force
- 12Paragraph 12 Not yet in force
- 13Paragraph 13 Not yet in force
- 14Paragraph 14 Not yet in force
- 15Paragraph 15 Not yet in force
- 16Paragraph 16 Not yet in force
- Part 2: Amendments of other legislation Not yet in force
- 17Registration Service Act 1953 Not yet in force
- 18Registration Service Act 1953 Not yet in force
- 19Registration Service Act 1953 Not yet in force
- 20Registration Service Act 1953 Not yet in force
- 21Public Records Act 1958 Not yet in force
- 22Social Security Administration Act 1992 Not yet in force
- 23Education Act 1996 Not yet in force
- 24Adoption and Children Act 2002 Not yet in force
- 25Gender Recognition Act 2004 Not yet in force
- 26Gender Recognition Act 2004 Not yet in force
- 27Gender Recognition Act 2004 Not yet in force
- 28Presumption of Death Act 2013 Not yet in force
- Schedule 4Lawfulness of processing: recognised legitimate interests
- Schedule 5Purpose limitation: processing to be treated as compatible with original purpose
- Schedule 6: Automated decision-making: minor and consequential amendments
- 1The UK GDPR
- 2Paragraph 2
- 3Paragraph 3
- 4Paragraph 4
- 5Paragraph 5
- 6Paragraph 6
- 7Paragraph 7
- 8Paragraph 8
- 9Paragraph 9
- 10The 2018 Act
- 11Paragraph 11
- 12Paragraph 12
- 13Paragraph 13
- 14Paragraph 14
- 15Paragraph 15
- 16Paragraph 16
- Schedule 7: Transfers of personal data to third countries etc: general processing
- 1Introduction
- 2General principles for transfers
- 3Transfers approved by regulations
- 4Paragraph 4
- 5Transfers approved by regulations: monitoring
- 6Transfers subject to appropriate safeguards
- 7Paragraph 7
- 8Paragraph 8
- 9Derogations for specific situations
- 10Public interest restrictions
- Schedule 8: Transfers of personal data to third countries etc: law enforcement processing
- 1Introduction
- 2Overview and interpretation
- 3General principles for transfer
- 4Transfers approved by regulations
- 5Transfers approved by regulations: monitoring
- 6Transfers subject to appropriate safeguards
- 7Transfers based on special circumstances
- 8Transfers to particular recipients
- 9Paragraph 9
- 10Subsequent transfers
- Schedule 9: Transfers of personal data to third countries etc: minor and consequential amendments and transitional provision
- Part 1: Minor and consequential amendments
- 1The UK GDPR
- 2Paragraph 2
- 3Paragraph 3
- 4Paragraph 4
- 5Paragraph 5
- 6Paragraph 6
- 7Paragraph 7
- 8Paragraph 8
- 9Paragraph 9
- 10Paragraph 10
- 11The 2018 Act
- 12Paragraph 12
- 13Paragraph 13
- 14Paragraph 14
- 15Paragraph 15
- 16Paragraph 16
- 17Paragraph 17
- 18Paragraph 18
- 19Paragraph 19
- 20Paragraph 20
- 21Paragraph 21
- 22Paragraph 22
- 23Paragraph 23
- 24Paragraph 24
- 25Paragraph 25
- Part 2: Transitional provision
- 26The UK GDPR: transfers approved by regulations
- 27The UK GDPR: transfers subject to appropriate safeguards
- 28The UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses
- 29Paragraph 29
- 30The UK GDPR: transfers necessary for important reasons of public interest
- 31The UK GDPR: restrictions on transfers of personal data to third countries and international organisations
- 32Part 3 of the 2018 Act (law enforcement processing): transfers approved by regulations
- 33Part 3 of the 2018 Act (law enforcement processing): transfers subject to appropriate safeguards
- Schedule 10: Complaints: minor and consequential amendments
- 1The UK GDPR
- 2The UK GDPR
- 3The UK GDPR
- 4The UK GDPR
- 5The UK GDPR
- 6The UK GDPR
- 7The UK GDPR
- 8The 2018 Act
- 9The 2018 Act
- 10The 2018 Act
- 11The 2018 Act
- 12The 2018 Act
- 13The 2018 Act
- 14The 2018 Act
- 15The 2018 Act
- 16The 2018 Act
- 17The 2018 Act
- 18The 2018 Act
- 19The 2018 Act
- 20The 2018 Act
- 21The 2018 Act
- Schedule 11: Further minor provision about data protection
- 1The UK GDPR
- 2The UK GDPR
- 3The UK GDPR
- 4The UK GDPR
- 5The UK GDPR
- 6The UK GDPR
- 7The UK GDPR
- 8The UK GDPR
- 9The UK GDPR
- 10The UK GDPR
- 11The UK GDPR
- 12The UK GDPR
- 13The 2018 Act
- 14Paragraph 14
- 15Paragraph 15
- 16Paragraph 16
- 17Paragraph 17
- 18Paragraph 18
- 19Paragraph 19
- 20Paragraph 20
- 21Paragraph 21
- 22Paragraph 22
- 23Paragraph 23
- 24Paragraph 24
- 25Paragraph 25
- 26Paragraph 26
- 27Paragraph 27
- 28Paragraph 28
- 29Paragraph 29
- 30Paragraph 30
- 31Paragraph 31
- 32Victims and Prisoners Act 2024
- Schedule 12Storing information in the terminal equipment of a subscriber or user
- Schedule 13Privacy and electronic communications: Commissioner’s enforcement powers
- Schedule 14: The Information Commission
- 1Schedule 12A to the Data Protection Act 2018
- 2Transitional provision: first chair
- 3Transitional provision: consultation about non-executive members
- 4Transitional provision: consultation about interim chief executive
- Schedule 16: Grant of smart meter communication licences
- Part 1: Amendments of the Energy Act 2008
- 1Paragraph 1
- 4Paragraph 4