OpenLegislation

Data (Use and Access) Act 2025 in Wales

2025 c. 18 · Enacted 19 June 2025 · Extends to United Kingdom

Up to date with all changes known to legislation.gov.uk, revised to 30 September 2026.

An Act to make provision about access to customer data and business data; to make provision about services consisting of the use of information to ascertain and verify facts about individuals; to make provision about the recording and sharing, and keeping of registers, of information relating to apparatus in streets; to make provision about the keeping and maintenance of registers of births and deaths; to make provision for the regulation of the processing of information relating to identified or identifiable living individuals; to make provision about privacy and electronic communications; to establish the Information Commission; to make provision about information standards for health and social care; to make provision about the grant of smart meter communication licences; to make provision about the disclosure of information to improve public service delivery; to make provision about the retention of information by providers of internet services in connection with investigations into child deaths; to make provision about providing information for purposes related to the carrying out of independent research into online safety matters; to make provision about the retention of biometric data; to make provision about services for the provision of electronic signatures, electronic seals and other trust services; to make provision about works protected by copyright and the development of artificial intelligence systems; to make provision about the creation of purported intimate images; and for connected purposes.

[19th June 2025]

Be it enacted by the King’s most Excellent Majesty, by and with the advice and consent of the Lords Spiritual and Temporal, and Commons, in this present Parliament assembled, and by the authority of the same, as follows:—

Contents

  1. Part 1: Access to customer data and business data
  2. Introductory
  3. 1Customer data and business data
  4. Data regulations
  5. 2Power to make provision in connection with customer data
  6. 3Customer data: supplementary
  7. 4Power to make provision in connection with business data
  8. 5Business data: supplementary
  9. 6Decision-makers
  10. 7Interface bodies
  11. Enforcement
  12. 8Enforcement of regulations under this Part
  13. 9Restrictions on powers of investigation etc
  14. 10Financial penalties
  15. Fees etc and financial assistance
  16. 11Fees
  17. 12Levy
  18. 13Financial assistance
  19. Financial services sector
  20. 14The FCA and financial services interfaces
  21. 15The FCA and financial services interfaces: supplementary
  22. 16The FCA and financial services interfaces: penalties and levies
  23. 17The FCA and co-ordination with other regulators
  24. Supplementary
  25. 18Liability in damages
  26. 19Duty to review regulations
  27. 20Restrictions on processing and data protection
  28. 21Regulations under this Part: supplementary
  29. 22Regulations under this Part: Parliamentary procedure and consultation
  30. 23Related subordinate legislation
  31. 24Repeal of provisions relating to supply of customer data
  32. 25Other defined terms
  33. 26Index of defined terms for this Part
  34. Part 2: Digital verification services
  35. Introductory
  36. 27Introductory
  37. DVS trust framework and supplementary codes
  38. 28DVS trust framework
  39. 29Supplementary codes
  40. 30Withdrawal of a supplementary code
  41. 31Review of DVS trust framework and supplementary codes
  42. DVS register
  43. 32DVS register
  44. 33Registration in the DVS register
  45. 34Power to refuse registration in the DVS register
  46. 35Registration of additional services
  47. 36Supplementary notes
  48. 37Addition of services to supplementary notes
  49. 38Applications for registration, supplementary notes, etc
  50. 39Fees for applications for registration, supplementary notes, etc
  51. 40Duty to remove person from the DVS register
  52. 41Power to remove person from the DVS register
  53. 42Duty to remove services from the DVS register
  54. 43Duty to remove supplementary notes from the DVS register
  55. 44Duty to remove services from supplementary notes
  56. Information gateway
  57. 45Power of public authority to disclose information to registered person Not yet in force
  58. 46Information disclosed by the Revenue and Customs Not yet in force
  59. 47Information disclosed by the Welsh Revenue Authority Not yet in force
  60. 48Information disclosed by Revenue Scotland Not yet in force
  61. 49Code of practice about the disclosure of information
  62. Trust mark
  63. 50Trust mark for use by registered persons
  64. Supplementary
  65. 51Power of Secretary of State to require information
  66. 52Arrangements for third party to exercise functions
  67. 53Report on the operation of this Part
  68. 54Index of defined terms for this Part
  69. 55Powers relating to verification of identity or status
  70. Part 3: National Underground Asset Register
  71. 56National Underground Asset Register: England and Wales
  72. 57Information in relation to apparatus: England and Wales
  73. 60Pre-commencement consultation Not yet in force
  74. Part 4: Registers of births and deaths
  75. 61Form in which registers of births and deaths are to be kept Not yet in force
  76. 62Provision of equipment and facilities by local authorities Not yet in force
  77. 63Requirements to sign register
  78. 64Treatment of existing registers and records Not yet in force
  79. 65Minor and consequential amendments Not yet in force
  80. Part 5: Data protection and privacy
  81. Chapter 1: Data protection
  82. Terms used in this Chapter
  83. 66The 2018 Act and the UK GDPR
  84. Definitions in the UK GDPR and the 2018 Act
  85. 67Meaning of research and statistical purposes
  86. 68Consent to processing for the purposes of scientific research
  87. 69Consent to law enforcement processing
  88. Data protection principles
  89. 70Lawfulness of processing
  90. 71The purpose limitation
  91. 72Processing in reliance on relevant international law
  92. Processing of special categories of personal data
  93. 73Elected representatives responding to requests
  94. 74Processing of special categories of personal data
  95. Data subject’s rights
  96. 75Fees and reasons for responses to data subjects’ requests about law enforcement processing
  97. 76Time limits for responding to data subjects’ requests
  98. 77Information to be provided to data subjects
  99. 78Searches in response to data subjects’ requests
  100. 79Data subjects’ rights to information: legal professional privilege exemption
  101. Automated decision-making
  102. 80Automated decision-making
  103. Obligations of controllers
  104. 81Data protection by design: children’s higher protection matters
  105. Logging of law enforcement processing
  106. 82Logging of law enforcement processing
  107. Codes of conduct
  108. 83General processing and codes of conduct
  109. 84Law enforcement processing and codes of conduct
  110. International transfers of personal data
  111. 85Transfers of personal data to third countries and international organisations
  112. Safeguards for processing for research etc purposes
  113. 86Safeguards for processing for research etc purposes
  114. 87Section 86: consequential provision
  115. National security
  116. 88National security exemption
  117. Intelligence services
  118. 89Joint processing by intelligence services and competent authorities
  119. 90Joint processing: consequential amendments
  120. Information Commission's role
  121. 91Duties of the Commission in carrying out functions
  122. 92Codes of practice for the processing of personal data
  123. 93Codes of practice: panels and impact assessments
  124. 94Manifestly unfounded or excessive requests to the Commissioner
  125. 95Analysis of performance
  126. 96Notices from the Commissioner
  127. Enforcement
  128. 97Power of the Commissioner to require documents
  129. 98Power of the Commissioner to require a report
  130. 99Assessment notices: removal of OFSTED restriction
  131. 100Interview notices
  132. 101Penalty notices
  133. 102Annual report on regulatory action
  134. 103Complaints by data subjects
  135. 104Court procedure in connection with subject access requests
  136. 105Consequential amendments to the EITSET Regulations
  137. Protection of prohibitions, restrictions and data subject’s rights
  138. 106Protection of prohibitions, restrictions and data subject’s rights
  139. Miscellaneous
  140. 107Regulations under the UK GDPR
  141. 108Further minor provision about data protection
  142. Chapter 2: Privacy and electronic communications
  143. 109The PEC Regulations
  144. 110Interpretation of the PEC Regulations
  145. 111Duty to notify the Commissioner of personal data breach: time periods
  146. 112Storing information in the terminal equipment of a subscriber or user
  147. 113Emergency alerts: interpretation of time periods
  148. 114Use of electronic mail for direct marketing by charities
  149. 115Commissioner’s enforcement powers
  150. 116Codes of conduct
  151. Part 6: The Information Commission
  152. 117The Information Commission
  153. 118Abolition of the office of Information Commissioner
  154. 119Transfer of functions to the Information Commission
  155. 120Transfer of property etc to the Information Commission
  156. Part 7: Other provision about use of, or access to, data
  157. Information standards for health and social care
  158. 121Information standards for health and adult social care in England
  159. Smart meter communication services
  160. 122Grant of smart meter communication licences
  161. Information to improve public service delivery
  162. 123Disclosure of information to improve public service delivery to undertakings
  163. Retention of information by providers of internet services
  164. 124Retention of information by providers of internet services in connection with death of child
  165. Information for research about online safety matters
  166. 125Information for research about online safety matters
  167. Retention of biometric data
  168. 126Retention of biometric data and recordable offences
  169. 127Retention of pseudonymised biometric data
  170. 128Retention of biometric data from INTERPOL
  171. Trust services
  172. 129The eIDAS Regulation
  173. 130Recognition of EU conformity assessment bodies
  174. 131Removal of recognition of EU standards etc Not yet in force
  175. 132Recognition of overseas trust products
  176. 133Co-operation between supervisory authority and overseas authorities
  177. 134Time periods: the eIDAS Regulation and the EITSET Regulations
  178. Copyright works and artificial intelligence systems
  179. 135Economic impact assessment
  180. 136Report on the use of copyright works in the development of AI systems
  181. 137Progress statement
  182. Purported intimate images
  183. 138Creating, or requesting the creation of, purported intimate image of adult
  184. Part 8: Final provisions
  185. 139Power to make consequential amendments
  186. 140Regulations
  187. 141Extent
  188. 142Commencement
  189. 143Transitional, transitory and saving provision
  190. 144Short title
  191. Schedule 1National Underground Asset Register (England and Wales): monetary penalties
  192. Schedule 3: Registers of births and deaths: minor and consequential amendments Not yet in force
  193. Part 1: Amendments of the Births and Deaths Registration Act 1953 Not yet in force
  194. 1Paragraph 1 Not yet in force
  195. 2Paragraph 2 Not yet in force
  196. 3Paragraph 3 Not yet in force
  197. 4Paragraph 4 Not yet in force
  198. 5Paragraph 5 Not yet in force
  199. 6Paragraph 6 Not yet in force
  200. 7Paragraph 7 Not yet in force
  201. 8Paragraph 8 Not yet in force
  202. 9Paragraph 9 Not yet in force
  203. 10Paragraph 10 Not yet in force
  204. 11Paragraph 11 Not yet in force
  205. 12Paragraph 12 Not yet in force
  206. 13Paragraph 13 Not yet in force
  207. 14Paragraph 14 Not yet in force
  208. 15Paragraph 15 Not yet in force
  209. 16Paragraph 16 Not yet in force
  210. Part 2: Amendments of other legislation Not yet in force
  211. 17Registration Service Act 1953 Not yet in force
  212. 18Registration Service Act 1953 Not yet in force
  213. 19Registration Service Act 1953 Not yet in force
  214. 20Registration Service Act 1953 Not yet in force
  215. 21Public Records Act 1958 Not yet in force
  216. 22Social Security Administration Act 1992 Not yet in force
  217. 23Education Act 1996 Not yet in force
  218. 24Adoption and Children Act 2002 Not yet in force
  219. 25Gender Recognition Act 2004 Not yet in force
  220. 26Gender Recognition Act 2004 Not yet in force
  221. 27Gender Recognition Act 2004 Not yet in force
  222. 28Presumption of Death Act 2013 Not yet in force
  223. Schedule 4Lawfulness of processing: recognised legitimate interests
  224. Schedule 5Purpose limitation: processing to be treated as compatible with original purpose
  225. Schedule 6: Automated decision-making: minor and consequential amendments
  226. 1The UK GDPR
  227. 2Paragraph 2
  228. 3Paragraph 3
  229. 4Paragraph 4
  230. 5Paragraph 5
  231. 6Paragraph 6
  232. 7Paragraph 7
  233. 8Paragraph 8
  234. 9Paragraph 9
  235. 10The 2018 Act
  236. 11Paragraph 11
  237. 12Paragraph 12
  238. 13Paragraph 13
  239. 14Paragraph 14
  240. 15Paragraph 15
  241. 16Paragraph 16
  242. Schedule 7: Transfers of personal data to third countries etc: general processing
  243. 1Introduction
  244. 2General principles for transfers
  245. 3Transfers approved by regulations
  246. 4Paragraph 4
  247. 5Transfers approved by regulations: monitoring
  248. 6Transfers subject to appropriate safeguards
  249. 7Paragraph 7
  250. 8Paragraph 8
  251. 9Derogations for specific situations
  252. 10Public interest restrictions
  253. Schedule 8: Transfers of personal data to third countries etc: law enforcement processing
  254. 1Introduction
  255. 2Overview and interpretation
  256. 3General principles for transfer
  257. 4Transfers approved by regulations
  258. 5Transfers approved by regulations: monitoring
  259. 6Transfers subject to appropriate safeguards
  260. 7Transfers based on special circumstances
  261. 8Transfers to particular recipients
  262. 9Paragraph 9
  263. 10Subsequent transfers
  264. Schedule 9: Transfers of personal data to third countries etc: minor and consequential amendments and transitional provision
  265. Part 1: Minor and consequential amendments
  266. 1The UK GDPR
  267. 2Paragraph 2
  268. 3Paragraph 3
  269. 4Paragraph 4
  270. 5Paragraph 5
  271. 6Paragraph 6
  272. 7Paragraph 7
  273. 8Paragraph 8
  274. 9Paragraph 9
  275. 10Paragraph 10
  276. 11The 2018 Act
  277. 12Paragraph 12
  278. 13Paragraph 13
  279. 14Paragraph 14
  280. 15Paragraph 15
  281. 16Paragraph 16
  282. 17Paragraph 17
  283. 18Paragraph 18
  284. 19Paragraph 19
  285. 20Paragraph 20
  286. 21Paragraph 21
  287. 22Paragraph 22
  288. 23Paragraph 23
  289. 24Paragraph 24
  290. 25Paragraph 25
  291. Part 2: Transitional provision
  292. 26The UK GDPR: transfers approved by regulations
  293. 27The UK GDPR: transfers subject to appropriate safeguards
  294. 28The UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses
  295. 29Paragraph 29
  296. 30The UK GDPR: transfers necessary for important reasons of public interest
  297. 31The UK GDPR: restrictions on transfers of personal data to third countries and international organisations
  298. 32Part 3 of the 2018 Act (law enforcement processing): transfers approved by regulations
  299. 33Part 3 of the 2018 Act (law enforcement processing): transfers subject to appropriate safeguards
  300. Schedule 10: Complaints: minor and consequential amendments
  301. 1The UK GDPR
  302. 2The UK GDPR
  303. 3The UK GDPR
  304. 4The UK GDPR
  305. 5The UK GDPR
  306. 6The UK GDPR
  307. 7The UK GDPR
  308. 8The 2018 Act
  309. 9The 2018 Act
  310. 10The 2018 Act
  311. 11The 2018 Act
  312. 12The 2018 Act
  313. 13The 2018 Act
  314. 14The 2018 Act
  315. 15The 2018 Act
  316. 16The 2018 Act
  317. 17The 2018 Act
  318. 18The 2018 Act
  319. 19The 2018 Act
  320. 20The 2018 Act
  321. 21The 2018 Act
  322. Schedule 11: Further minor provision about data protection
  323. 1The UK GDPR
  324. 2The UK GDPR
  325. 3The UK GDPR
  326. 4The UK GDPR
  327. 5The UK GDPR
  328. 6The UK GDPR
  329. 7The UK GDPR
  330. 8The UK GDPR
  331. 9The UK GDPR
  332. 10The UK GDPR
  333. 11The UK GDPR
  334. 12The UK GDPR
  335. 13The 2018 Act
  336. 14Paragraph 14
  337. 15Paragraph 15
  338. 16Paragraph 16
  339. 17Paragraph 17
  340. 18Paragraph 18
  341. 19Paragraph 19
  342. 20Paragraph 20
  343. 21Paragraph 21
  344. 22Paragraph 22
  345. 23Paragraph 23
  346. 24Paragraph 24
  347. 25Paragraph 25
  348. 26Paragraph 26
  349. 27Paragraph 27
  350. 28Paragraph 28
  351. 29Paragraph 29
  352. 30Paragraph 30
  353. 31Paragraph 31
  354. 32Victims and Prisoners Act 2024
  355. Schedule 12Storing information in the terminal equipment of a subscriber or user
  356. Schedule 13Privacy and electronic communications: Commissioner’s enforcement powers
  357. Schedule 14: The Information Commission
  358. 1Schedule 12A to the Data Protection Act 2018
  359. 2Transitional provision: first chair
  360. 3Transitional provision: consultation about non-executive members
  361. 4Transitional provision: consultation about interim chief executive
  362. Schedule 15: Information standards for health and adult social care in England
  363. 1Paragraph 1
  364. 2Paragraph 2
  365. 3Paragraph 3
  366. 4Paragraph 4
  367. 5Paragraph 5
  368. 6Paragraph 6
  369. 7Paragraph 7
  370. 8Paragraph 8
  371. Schedule 16: Grant of smart meter communication licences
  372. Part 1: Amendments of the Energy Act 2008
  373. 1Paragraph 1
  374. 2Paragraph 2
  375. 3Paragraph 3
  376. 4Paragraph 4
  377. Part 2: Amendments of other legislation Not yet in force
  378. 5Gas Act 1986 Not yet in force
  379. 6Electricity Act 1989 Not yet in force
  380. 7Electricity and Gas (Competitive Tenders for Smart Meter Communication Licences) Regulations 2012 Not yet in force