OpenLegislation

Data (Use and Access) Act 2025 in Scotland

2025 c. 18 · Enacted 19 June 2025 · Extends to United Kingdom

Up to date with all changes known to legislation.gov.uk, revised to 30 September 2026.

An Act to make provision about access to customer data and business data; to make provision about services consisting of the use of information to ascertain and verify facts about individuals; to make provision about the recording and sharing, and keeping of registers, of information relating to apparatus in streets; to make provision about the keeping and maintenance of registers of births and deaths; to make provision for the regulation of the processing of information relating to identified or identifiable living individuals; to make provision about privacy and electronic communications; to establish the Information Commission; to make provision about information standards for health and social care; to make provision about the grant of smart meter communication licences; to make provision about the disclosure of information to improve public service delivery; to make provision about the retention of information by providers of internet services in connection with investigations into child deaths; to make provision about providing information for purposes related to the carrying out of independent research into online safety matters; to make provision about the retention of biometric data; to make provision about services for the provision of electronic signatures, electronic seals and other trust services; to make provision about works protected by copyright and the development of artificial intelligence systems; to make provision about the creation of purported intimate images; and for connected purposes.

[19th June 2025]

Be it enacted by the King’s most Excellent Majesty, by and with the advice and consent of the Lords Spiritual and Temporal, and Commons, in this present Parliament assembled, and by the authority of the same, as follows:—

Contents

  1. Part 1: Access to customer data and business data
  2. Introductory
  3. 1Customer data and business data
  4. Data regulations
  5. 2Power to make provision in connection with customer data
  6. 3Customer data: supplementary
  7. 4Power to make provision in connection with business data
  8. 5Business data: supplementary
  9. 6Decision-makers
  10. 7Interface bodies
  11. Enforcement
  12. 8Enforcement of regulations under this Part
  13. 9Restrictions on powers of investigation etc
  14. 10Financial penalties
  15. Fees etc and financial assistance
  16. 11Fees
  17. 12Levy
  18. 13Financial assistance
  19. Financial services sector
  20. 14The FCA and financial services interfaces
  21. 15The FCA and financial services interfaces: supplementary
  22. 16The FCA and financial services interfaces: penalties and levies
  23. 17The FCA and co-ordination with other regulators
  24. Supplementary
  25. 18Liability in damages
  26. 19Duty to review regulations
  27. 20Restrictions on processing and data protection
  28. 21Regulations under this Part: supplementary
  29. 22Regulations under this Part: Parliamentary procedure and consultation
  30. 23Related subordinate legislation
  31. 24Repeal of provisions relating to supply of customer data
  32. 25Other defined terms
  33. 26Index of defined terms for this Part
  34. Part 2: Digital verification services
  35. Introductory
  36. 27Introductory
  37. DVS trust framework and supplementary codes
  38. 28DVS trust framework
  39. 29Supplementary codes
  40. 30Withdrawal of a supplementary code
  41. 31Review of DVS trust framework and supplementary codes
  42. DVS register
  43. 32DVS register
  44. 33Registration in the DVS register
  45. 34Power to refuse registration in the DVS register
  46. 35Registration of additional services
  47. 36Supplementary notes
  48. 37Addition of services to supplementary notes
  49. 38Applications for registration, supplementary notes, etc
  50. 39Fees for applications for registration, supplementary notes, etc
  51. 40Duty to remove person from the DVS register
  52. 41Power to remove person from the DVS register
  53. 42Duty to remove services from the DVS register
  54. 43Duty to remove supplementary notes from the DVS register
  55. 44Duty to remove services from supplementary notes
  56. Information gateway
  57. 45Power of public authority to disclose information to registered person Not yet in force
  58. 46Information disclosed by the Revenue and Customs Not yet in force
  59. 47Information disclosed by the Welsh Revenue Authority Not yet in force
  60. 48Information disclosed by Revenue Scotland Not yet in force
  61. 49Code of practice about the disclosure of information
  62. Trust mark
  63. 50Trust mark for use by registered persons
  64. Supplementary
  65. 51Power of Secretary of State to require information
  66. 52Arrangements for third party to exercise functions
  67. 53Report on the operation of this Part
  68. 54Index of defined terms for this Part
  69. 55Powers relating to verification of identity or status
  70. Part 3: National Underground Asset Register
  71. 57Information in relation to apparatus: England and Wales
  72. Part 4: Registers of births and deaths
  73. 65Minor and consequential amendments Not yet in force
  74. Part 5: Data protection and privacy
  75. Chapter 1: Data protection
  76. Terms used in this Chapter
  77. 66The 2018 Act and the UK GDPR
  78. Definitions in the UK GDPR and the 2018 Act
  79. 67Meaning of research and statistical purposes
  80. 68Consent to processing for the purposes of scientific research
  81. 69Consent to law enforcement processing
  82. Data protection principles
  83. 70Lawfulness of processing
  84. 71The purpose limitation
  85. 72Processing in reliance on relevant international law
  86. Processing of special categories of personal data
  87. 73Elected representatives responding to requests
  88. 74Processing of special categories of personal data
  89. Data subject’s rights
  90. 75Fees and reasons for responses to data subjects’ requests about law enforcement processing
  91. 76Time limits for responding to data subjects’ requests
  92. 77Information to be provided to data subjects
  93. 78Searches in response to data subjects’ requests
  94. 79Data subjects’ rights to information: legal professional privilege exemption
  95. Automated decision-making
  96. 80Automated decision-making
  97. Obligations of controllers
  98. 81Data protection by design: children’s higher protection matters
  99. Logging of law enforcement processing
  100. 82Logging of law enforcement processing
  101. Codes of conduct
  102. 83General processing and codes of conduct
  103. 84Law enforcement processing and codes of conduct
  104. International transfers of personal data
  105. 85Transfers of personal data to third countries and international organisations
  106. Safeguards for processing for research etc purposes
  107. 86Safeguards for processing for research etc purposes
  108. 87Section 86: consequential provision
  109. National security
  110. 88National security exemption
  111. Intelligence services
  112. 89Joint processing by intelligence services and competent authorities
  113. 90Joint processing: consequential amendments
  114. Information Commission's role
  115. 91Duties of the Commission in carrying out functions
  116. 92Codes of practice for the processing of personal data
  117. 93Codes of practice: panels and impact assessments
  118. 94Manifestly unfounded or excessive requests to the Commissioner
  119. 95Analysis of performance
  120. 96Notices from the Commissioner
  121. Enforcement
  122. 97Power of the Commissioner to require documents
  123. 98Power of the Commissioner to require a report
  124. 99Assessment notices: removal of OFSTED restriction
  125. 100Interview notices
  126. 101Penalty notices
  127. 102Annual report on regulatory action
  128. 103Complaints by data subjects
  129. 104Court procedure in connection with subject access requests
  130. 105Consequential amendments to the EITSET Regulations
  131. Protection of prohibitions, restrictions and data subject’s rights
  132. 106Protection of prohibitions, restrictions and data subject’s rights
  133. Miscellaneous
  134. 107Regulations under the UK GDPR
  135. 108Further minor provision about data protection
  136. Chapter 2: Privacy and electronic communications
  137. 109The PEC Regulations
  138. 110Interpretation of the PEC Regulations
  139. 111Duty to notify the Commissioner of personal data breach: time periods
  140. 112Storing information in the terminal equipment of a subscriber or user
  141. 113Emergency alerts: interpretation of time periods
  142. 114Use of electronic mail for direct marketing by charities
  143. 115Commissioner’s enforcement powers
  144. 116Codes of conduct
  145. Part 6: The Information Commission
  146. 117The Information Commission
  147. 118Abolition of the office of Information Commissioner
  148. 119Transfer of functions to the Information Commission
  149. 120Transfer of property etc to the Information Commission
  150. Part 7: Other provision about use of, or access to, data
  151. Smart meter communication services
  152. 122Grant of smart meter communication licences
  153. Information to improve public service delivery
  154. 123Disclosure of information to improve public service delivery to undertakings
  155. Retention of information by providers of internet services
  156. 124Retention of information by providers of internet services in connection with death of child
  157. Information for research about online safety matters
  158. 125Information for research about online safety matters
  159. Retention of biometric data
  160. 126Retention of biometric data and recordable offences
  161. 127Retention of pseudonymised biometric data
  162. 128Retention of biometric data from INTERPOL
  163. Trust services
  164. 129The eIDAS Regulation
  165. 130Recognition of EU conformity assessment bodies
  166. 131Removal of recognition of EU standards etc Not yet in force
  167. 132Recognition of overseas trust products
  168. 133Co-operation between supervisory authority and overseas authorities
  169. 134Time periods: the eIDAS Regulation and the EITSET Regulations
  170. Copyright works and artificial intelligence systems
  171. 135Economic impact assessment
  172. 136Report on the use of copyright works in the development of AI systems
  173. 137Progress statement
  174. Purported intimate images
  175. 138Creating, or requesting the creation of, purported intimate image of adult
  176. Part 8: Final provisions
  177. 139Power to make consequential amendments
  178. 140Regulations
  179. 141Extent
  180. 142Commencement
  181. 143Transitional, transitory and saving provision
  182. 144Short title
  183. Schedule 3: Registers of births and deaths: minor and consequential amendments Not yet in force
  184. Part 1: Amendments of the Births and Deaths Registration Act 1953 Not yet in force
  185. 1Paragraph 1 Not yet in force
  186. 2Paragraph 2 Not yet in force
  187. 3Paragraph 3 Not yet in force
  188. 4Paragraph 4 Not yet in force
  189. 5Paragraph 5 Not yet in force
  190. 6Paragraph 6 Not yet in force
  191. 7Paragraph 7 Not yet in force
  192. 8Paragraph 8 Not yet in force
  193. 9Paragraph 9 Not yet in force
  194. 10Paragraph 10 Not yet in force
  195. 11Paragraph 11 Not yet in force
  196. 12Paragraph 12 Not yet in force
  197. 13Paragraph 13 Not yet in force
  198. 14Paragraph 14 Not yet in force
  199. 15Paragraph 15 Not yet in force
  200. 16Paragraph 16 Not yet in force
  201. Part 2: Amendments of other legislation Not yet in force
  202. 17Registration Service Act 1953 Not yet in force
  203. 18Registration Service Act 1953 Not yet in force
  204. 19Registration Service Act 1953 Not yet in force
  205. 20Registration Service Act 1953 Not yet in force
  206. 21Public Records Act 1958 Not yet in force
  207. 22Social Security Administration Act 1992 Not yet in force
  208. 23Education Act 1996 Not yet in force
  209. 24Adoption and Children Act 2002 Not yet in force
  210. 25Gender Recognition Act 2004 Not yet in force
  211. 26Gender Recognition Act 2004 Not yet in force
  212. 27Gender Recognition Act 2004 Not yet in force
  213. 28Presumption of Death Act 2013 Not yet in force
  214. Schedule 4Lawfulness of processing: recognised legitimate interests
  215. Schedule 5Purpose limitation: processing to be treated as compatible with original purpose
  216. Schedule 6: Automated decision-making: minor and consequential amendments
  217. 1The UK GDPR
  218. 2Paragraph 2
  219. 3Paragraph 3
  220. 4Paragraph 4
  221. 5Paragraph 5
  222. 6Paragraph 6
  223. 7Paragraph 7
  224. 8Paragraph 8
  225. 9Paragraph 9
  226. 10The 2018 Act
  227. 11Paragraph 11
  228. 12Paragraph 12
  229. 13Paragraph 13
  230. 14Paragraph 14
  231. 15Paragraph 15
  232. 16Paragraph 16
  233. Schedule 7: Transfers of personal data to third countries etc: general processing
  234. 1Introduction
  235. 2General principles for transfers
  236. 3Transfers approved by regulations
  237. 4Paragraph 4
  238. 5Transfers approved by regulations: monitoring
  239. 6Transfers subject to appropriate safeguards
  240. 7Paragraph 7
  241. 8Paragraph 8
  242. 9Derogations for specific situations
  243. 10Public interest restrictions
  244. Schedule 8: Transfers of personal data to third countries etc: law enforcement processing
  245. 1Introduction
  246. 2Overview and interpretation
  247. 3General principles for transfer
  248. 4Transfers approved by regulations
  249. 5Transfers approved by regulations: monitoring
  250. 6Transfers subject to appropriate safeguards
  251. 7Transfers based on special circumstances
  252. 8Transfers to particular recipients
  253. 9Paragraph 9
  254. 10Subsequent transfers
  255. Schedule 9: Transfers of personal data to third countries etc: minor and consequential amendments and transitional provision
  256. Part 1: Minor and consequential amendments
  257. 1The UK GDPR
  258. 2Paragraph 2
  259. 3Paragraph 3
  260. 4Paragraph 4
  261. 5Paragraph 5
  262. 6Paragraph 6
  263. 7Paragraph 7
  264. 8Paragraph 8
  265. 9Paragraph 9
  266. 10Paragraph 10
  267. 11The 2018 Act
  268. 12Paragraph 12
  269. 13Paragraph 13
  270. 14Paragraph 14
  271. 15Paragraph 15
  272. 16Paragraph 16
  273. 17Paragraph 17
  274. 18Paragraph 18
  275. 19Paragraph 19
  276. 20Paragraph 20
  277. 21Paragraph 21
  278. 22Paragraph 22
  279. 23Paragraph 23
  280. 24Paragraph 24
  281. 25Paragraph 25
  282. Part 2: Transitional provision
  283. 26The UK GDPR: transfers approved by regulations
  284. 27The UK GDPR: transfers subject to appropriate safeguards
  285. 28The UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses
  286. 29Paragraph 29
  287. 30The UK GDPR: transfers necessary for important reasons of public interest
  288. 31The UK GDPR: restrictions on transfers of personal data to third countries and international organisations
  289. 32Part 3 of the 2018 Act (law enforcement processing): transfers approved by regulations
  290. 33Part 3 of the 2018 Act (law enforcement processing): transfers subject to appropriate safeguards
  291. Schedule 10: Complaints: minor and consequential amendments
  292. 1The UK GDPR
  293. 2The UK GDPR
  294. 3The UK GDPR
  295. 4The UK GDPR
  296. 5The UK GDPR
  297. 6The UK GDPR
  298. 7The UK GDPR
  299. 8The 2018 Act
  300. 9The 2018 Act
  301. 10The 2018 Act
  302. 11The 2018 Act
  303. 12The 2018 Act
  304. 13The 2018 Act
  305. 14The 2018 Act
  306. 15The 2018 Act
  307. 16The 2018 Act
  308. 17The 2018 Act
  309. 18The 2018 Act
  310. 19The 2018 Act
  311. 20The 2018 Act
  312. 21The 2018 Act
  313. Schedule 11: Further minor provision about data protection
  314. 1The UK GDPR
  315. 2The UK GDPR
  316. 3The UK GDPR
  317. 4The UK GDPR
  318. 5The UK GDPR
  319. 6The UK GDPR
  320. 7The UK GDPR
  321. 8The UK GDPR
  322. 9The UK GDPR
  323. 10The UK GDPR
  324. 11The UK GDPR
  325. 12The UK GDPR
  326. 13The 2018 Act
  327. 14Paragraph 14
  328. 15Paragraph 15
  329. 16Paragraph 16
  330. 17Paragraph 17
  331. 18Paragraph 18
  332. 19Paragraph 19
  333. 20Paragraph 20
  334. 21Paragraph 21
  335. 22Paragraph 22
  336. 23Paragraph 23
  337. 24Paragraph 24
  338. 25Paragraph 25
  339. 26Paragraph 26
  340. 27Paragraph 27
  341. 28Paragraph 28
  342. 29Paragraph 29
  343. 30Paragraph 30
  344. 31Paragraph 31
  345. 32Victims and Prisoners Act 2024
  346. Schedule 12Storing information in the terminal equipment of a subscriber or user
  347. Schedule 13Privacy and electronic communications: Commissioner’s enforcement powers
  348. Schedule 14: The Information Commission
  349. 1Schedule 12A to the Data Protection Act 2018
  350. 2Transitional provision: first chair
  351. 3Transitional provision: consultation about non-executive members
  352. 4Transitional provision: consultation about interim chief executive
  353. Schedule 16: Grant of smart meter communication licences
  354. Part 1: Amendments of the Energy Act 2008
  355. 1Paragraph 1
  356. 2Paragraph 2
  357. 3Paragraph 3
  358. 4Paragraph 4
  359. Part 2: Amendments of other legislation Not yet in force
  360. 5Gas Act 1986 Not yet in force
  361. 6Electricity Act 1989 Not yet in force
  362. 7Electricity and Gas (Competitive Tenders for Smart Meter Communication Licences) Regulations 2012 Not yet in force