OpenLegislation

Data (Use and Access) Act 2025

2025 c. 18 · Enacted 19 June 2025 · Extends to United Kingdom

Up to date with all changes known to legislation.gov.uk, revised to 30 September 2026.

An Act to make provision about access to customer data and business data; to make provision about services consisting of the use of information to ascertain and verify facts about individuals; to make provision about the recording and sharing, and keeping of registers, of information relating to apparatus in streets; to make provision about the keeping and maintenance of registers of births and deaths; to make provision for the regulation of the processing of information relating to identified or identifiable living individuals; to make provision about privacy and electronic communications; to establish the Information Commission; to make provision about information standards for health and social care; to make provision about the grant of smart meter communication licences; to make provision about the disclosure of information to improve public service delivery; to make provision about the retention of information by providers of internet services in connection with investigations into child deaths; to make provision about providing information for purposes related to the carrying out of independent research into online safety matters; to make provision about the retention of biometric data; to make provision about services for the provision of electronic signatures, electronic seals and other trust services; to make provision about works protected by copyright and the development of artificial intelligence systems; to make provision about the creation of purported intimate images; and for connected purposes. [19th June 2025]

Be it enacted by the King’s most Excellent Majesty, by and with the advice and consent of the Lords Spiritual and Temporal, and Commons, in this present Parliament assembled, and by the authority of the same, as follows:—

Contents

  1. Part 1: Access to customer data and business data
  2. Introductory
  3. 1Customer data and business data
  4. Data regulations
  5. 2Power to make provision in connection with customer data
  6. 3Customer data: supplementary
  7. 4Power to make provision in connection with business data
  8. 5Business data: supplementary
  9. 6Decision-makers
  10. 7Interface bodies
  11. Enforcement
  12. 8Enforcement of regulations under this Part
  13. 9Restrictions on powers of investigation etc
  14. 10Financial penalties
  15. Fees etc and financial assistance
  16. 11Fees
  17. 12Levy
  18. 13Financial assistance
  19. Financial services sector
  20. 14The FCA and financial services interfaces
  21. 15The FCA and financial services interfaces: supplementary
  22. 16The FCA and financial services interfaces: penalties and levies
  23. 17The FCA and co-ordination with other regulators
  24. Supplementary
  25. 18Liability in damages
  26. 19Duty to review regulations
  27. 20Restrictions on processing and data protection
  28. 21Regulations under this Part: supplementary
  29. 22Regulations under this Part: Parliamentary procedure and consultation
  30. 23Related subordinate legislation
  31. 24Repeal of provisions relating to supply of customer data
  32. 25Other defined terms
  33. 26Index of defined terms for this Part
  34. Part 2: Digital verification services
  35. Introductory
  36. 27Introductory
  37. DVS trust framework and supplementary codes
  38. 28DVS trust framework
  39. 29Supplementary codes
  40. 30Withdrawal of a supplementary code
  41. 31Review of DVS trust framework and supplementary codes
  42. DVS register
  43. 32DVS register
  44. 33Registration in the DVS register
  45. 34Power to refuse registration in the DVS register
  46. 35Registration of additional services
  47. 36Supplementary notes
  48. 37Addition of services to supplementary notes
  49. 38Applications for registration, supplementary notes, etc
  50. 39Fees for applications for registration, supplementary notes, etc
  51. 40Duty to remove person from the DVS register
  52. 41Power to remove person from the DVS register
  53. 42Duty to remove services from the DVS register
  54. 43Duty to remove supplementary notes from the DVS register
  55. 44Duty to remove services from supplementary notes
  56. Information gateway
  57. 45Power of public authority to disclose information to registered person Not yet in force
  58. 46Information disclosed by the Revenue and Customs Not yet in force
  59. 47Information disclosed by the Welsh Revenue Authority Not yet in force
  60. 48Information disclosed by Revenue Scotland Not yet in force
  61. 49Code of practice about the disclosure of information
  62. Trust mark
  63. 50Trust mark for use by registered persons
  64. Supplementary
  65. 51Power of Secretary of State to require information
  66. 52Arrangements for third party to exercise functions
  67. 53Report on the operation of this Part
  68. 54Index of defined terms for this Part
  69. 55Powers relating to verification of identity or status
  70. Part 3: National Underground Asset Register
  71. 56National Underground Asset Register: England and Wales
  72. 57Information in relation to apparatus: England and Wales
  73. 58National Underground Asset Register: Northern Ireland
  74. 59Information in relation to apparatus: Northern Ireland
  75. 60Pre-commencement consultation Not yet in force
  76. Part 4: Registers of births and deaths
  77. 61Form in which registers of births and deaths are to be kept Not yet in force
  78. 62Provision of equipment and facilities by local authorities Not yet in force
  79. 63Requirements to sign register
  80. 64Treatment of existing registers and records Not yet in force
  81. 65Minor and consequential amendments Not yet in force
  82. Part 5: Data protection and privacy
  83. Chapter 1: Data protection
  84. Terms used in this Chapter
  85. 66The 2018 Act and the UK GDPR
  86. Definitions in the UK GDPR and the 2018 Act
  87. 67Meaning of research and statistical purposes
  88. 68Consent to processing for the purposes of scientific research
  89. 69Consent to law enforcement processing
  90. Data protection principles
  91. 70Lawfulness of processing
  92. 71The purpose limitation
  93. 72Processing in reliance on relevant international law
  94. Processing of special categories of personal data
  95. 73Elected representatives responding to requests
  96. 74Processing of special categories of personal data
  97. Data subject’s rights
  98. 75Fees and reasons for responses to data subjects’ requests about law enforcement processing
  99. 76Time limits for responding to data subjects’ requests
  100. 77Information to be provided to data subjects
  101. 78Searches in response to data subjects’ requests
  102. 79Data subjects’ rights to information: legal professional privilege exemption
  103. Automated decision-making
  104. 80Automated decision-making
  105. Obligations of controllers
  106. 81Data protection by design: children’s higher protection matters
  107. Logging of law enforcement processing
  108. 82Logging of law enforcement processing
  109. Codes of conduct
  110. 83General processing and codes of conduct
  111. 84Law enforcement processing and codes of conduct
  112. International transfers of personal data
  113. 85Transfers of personal data to third countries and international organisations
  114. Safeguards for processing for research etc purposes
  115. 86Safeguards for processing for research etc purposes
  116. 87Section 86: consequential provision
  117. National security
  118. 88National security exemption
  119. Intelligence services
  120. 89Joint processing by intelligence services and competent authorities
  121. 90Joint processing: consequential amendments
  122. Information Commission's role
  123. 91Duties of the Commission in carrying out functions
  124. 92Codes of practice for the processing of personal data
  125. 93Codes of practice: panels and impact assessments
  126. 94Manifestly unfounded or excessive requests to the Commissioner
  127. 95Analysis of performance
  128. 96Notices from the Commissioner
  129. Enforcement
  130. 97Power of the Commissioner to require documents
  131. 98Power of the Commissioner to require a report
  132. 99Assessment notices: removal of OFSTED restriction
  133. 100Interview notices
  134. 101Penalty notices
  135. 102Annual report on regulatory action
  136. 103Complaints by data subjects
  137. 104Court procedure in connection with subject access requests
  138. 105Consequential amendments to the EITSET Regulations
  139. Protection of prohibitions, restrictions and data subject’s rights
  140. 106Protection of prohibitions, restrictions and data subject’s rights
  141. Miscellaneous
  142. 107Regulations under the UK GDPR
  143. 108Further minor provision about data protection
  144. Chapter 2: Privacy and electronic communications
  145. 109The PEC Regulations
  146. 110Interpretation of the PEC Regulations
  147. 111Duty to notify the Commissioner of personal data breach: time periods
  148. 112Storing information in the terminal equipment of a subscriber or user
  149. 113Emergency alerts: interpretation of time periods
  150. 114Use of electronic mail for direct marketing by charities
  151. 115Commissioner’s enforcement powers
  152. 116Codes of conduct
  153. Part 6: The Information Commission
  154. 117The Information Commission
  155. 118Abolition of the office of Information Commissioner
  156. 119Transfer of functions to the Information Commission
  157. 120Transfer of property etc to the Information Commission
  158. Part 7: Other provision about use of, or access to, data
  159. Information standards for health and social care
  160. 121Information standards for health and adult social care in England
  161. Smart meter communication services
  162. 122Grant of smart meter communication licences
  163. Information to improve public service delivery
  164. 123Disclosure of information to improve public service delivery to undertakings
  165. Retention of information by providers of internet services
  166. 124Retention of information by providers of internet services in connection with death of child
  167. Information for research about online safety matters
  168. 125Information for research about online safety matters
  169. Retention of biometric data
  170. 126Retention of biometric data and recordable offences
  171. 127Retention of pseudonymised biometric data
  172. 128Retention of biometric data from INTERPOL
  173. Trust services
  174. 129The eIDAS Regulation
  175. 130Recognition of EU conformity assessment bodies
  176. 131Removal of recognition of EU standards etc Not yet in force
  177. 132Recognition of overseas trust products
  178. 133Co-operation between supervisory authority and overseas authorities
  179. 134Time periods: the eIDAS Regulation and the EITSET Regulations
  180. Copyright works and artificial intelligence systems
  181. 135Economic impact assessment
  182. 136Report on the use of copyright works in the development of AI systems
  183. 137Progress statement
  184. Purported intimate images
  185. 138Creating, or requesting the creation of, purported intimate image of adult
  186. Part 8: Final provisions
  187. 139Power to make consequential amendments
  188. 140Regulations
  189. 141Extent
  190. 142Commencement
  191. 143Transitional, transitory and saving provision
  192. 144Short title
  193. Schedule 1: National Underground Asset Register (England and Wales): monetary penalties
  194. Schedule 2: National Underground Asset Register (Northern Ireland): monetary penalties
  195. Schedule 3: Registers of births and deaths: minor and consequential amendments Not yet in force
  196. Part 1: Amendments of the Births and Deaths Registration Act 1953 Not yet in force
  197. 1Paragraph 1 Not yet in force
  198. 2Paragraph 2 Not yet in force
  199. 3Paragraph 3 Not yet in force
  200. 4Paragraph 4 Not yet in force
  201. 5Paragraph 5 Not yet in force
  202. 6Paragraph 6 Not yet in force
  203. 7Paragraph 7 Not yet in force
  204. 8Paragraph 8 Not yet in force
  205. 9Paragraph 9 Not yet in force
  206. 10Paragraph 10 Not yet in force
  207. 11Paragraph 11 Not yet in force
  208. 12Paragraph 12 Not yet in force
  209. 13Paragraph 13 Not yet in force
  210. 14Paragraph 14 Not yet in force
  211. 15Paragraph 15 Not yet in force
  212. 16Paragraph 16 Not yet in force
  213. Part 2: Amendments of other legislation Not yet in force
  214. 17Registration Service Act 1953 Not yet in force
  215. 18Registration Service Act 1953 Not yet in force
  216. 19Registration Service Act 1953 Not yet in force
  217. 20Registration Service Act 1953 Not yet in force
  218. 21Public Records Act 1958 Not yet in force
  219. 22Social Security Administration Act 1992 Not yet in force
  220. 23Education Act 1996 Not yet in force
  221. 24Adoption and Children Act 2002 Not yet in force
  222. 25Gender Recognition Act 2004 Not yet in force
  223. 26Gender Recognition Act 2004 Not yet in force
  224. 27Gender Recognition Act 2004 Not yet in force
  225. 28Presumption of Death Act 2013 Not yet in force
  226. Schedule 4: Lawfulness of processing: recognised legitimate interests
  227. Schedule 5: Purpose limitation: processing to be treated as compatible with original purpose
  228. Schedule 6: Automated decision-making: minor and consequential amendments
  229. 1The UK GDPR
  230. 2Paragraph 2
  231. 3Paragraph 3
  232. 4Paragraph 4
  233. 5Paragraph 5
  234. 6Paragraph 6
  235. 7Paragraph 7
  236. 8Paragraph 8
  237. 9Paragraph 9
  238. 10The 2018 Act
  239. 11Paragraph 11
  240. 12Paragraph 12
  241. 13Paragraph 13
  242. 14Paragraph 14
  243. 15Paragraph 15
  244. 16Paragraph 16
  245. Schedule 7: Transfers of personal data to third countries etc: general processing
  246. 1Introduction
  247. 2General principles for transfers
  248. 3Transfers approved by regulations
  249. 4Paragraph 4
  250. 5Transfers approved by regulations: monitoring
  251. 6Transfers subject to appropriate safeguards
  252. 7Paragraph 7
  253. 8Paragraph 8
  254. 9Derogations for specific situations
  255. 10Public interest restrictions
  256. Schedule 8: Transfers of personal data to third countries etc: law enforcement processing
  257. 1Introduction
  258. 2Overview and interpretation
  259. 3General principles for transfer
  260. 4Transfers approved by regulations
  261. 5Transfers approved by regulations: monitoring
  262. 6Transfers subject to appropriate safeguards
  263. 7Transfers based on special circumstances
  264. 8Transfers to particular recipients
  265. 9Paragraph 9
  266. 10Subsequent transfers
  267. Schedule 9: Transfers of personal data to third countries etc: minor and consequential amendments and transitional provision
  268. Part 1: Minor and consequential amendments
  269. 1The UK GDPR
  270. 2Paragraph 2
  271. 3Paragraph 3
  272. 4Paragraph 4
  273. 5Paragraph 5
  274. 6Paragraph 6
  275. 7Paragraph 7
  276. 8Paragraph 8
  277. 9Paragraph 9
  278. 10Paragraph 10
  279. 11The 2018 Act
  280. 12Paragraph 12
  281. 13Paragraph 13
  282. 14Paragraph 14
  283. 15Paragraph 15
  284. 16Paragraph 16
  285. 17Paragraph 17
  286. 18Paragraph 18
  287. 19Paragraph 19
  288. 20Paragraph 20
  289. 21Paragraph 21
  290. 22Paragraph 22
  291. 23Paragraph 23
  292. 24Paragraph 24
  293. 25Paragraph 25
  294. Part 2: Transitional provision
  295. 26The UK GDPR: transfers approved by regulations
  296. 27The UK GDPR: transfers subject to appropriate safeguards
  297. 28The UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses
  298. 29Paragraph 29
  299. 30The UK GDPR: transfers necessary for important reasons of public interest
  300. 31The UK GDPR: restrictions on transfers of personal data to third countries and international organisations
  301. 32Part 3 of the 2018 Act (law enforcement processing): transfers approved by regulations
  302. 33Part 3 of the 2018 Act (law enforcement processing): transfers subject to appropriate safeguards
  303. Schedule 10: Complaints: minor and consequential amendments
  304. 1The UK GDPR
  305. 2The UK GDPR
  306. 3The UK GDPR
  307. 4The UK GDPR
  308. 5The UK GDPR
  309. 6The UK GDPR
  310. 7The UK GDPR
  311. 8The 2018 Act
  312. 9The 2018 Act
  313. 10The 2018 Act
  314. 11The 2018 Act
  315. 12The 2018 Act
  316. 13The 2018 Act
  317. 14The 2018 Act
  318. 15The 2018 Act
  319. 16The 2018 Act
  320. 17The 2018 Act
  321. 18The 2018 Act
  322. 19The 2018 Act
  323. 20The 2018 Act
  324. 21The 2018 Act
  325. Schedule 11: Further minor provision about data protection
  326. 1The UK GDPR
  327. 2The UK GDPR
  328. 3The UK GDPR
  329. 4The UK GDPR
  330. 5The UK GDPR
  331. 6The UK GDPR
  332. 7The UK GDPR
  333. 8The UK GDPR
  334. 9The UK GDPR
  335. 10The UK GDPR
  336. 11The UK GDPR
  337. 12The UK GDPR
  338. 13The 2018 Act
  339. 14Paragraph 14
  340. 15Paragraph 15
  341. 16Paragraph 16
  342. 17Paragraph 17
  343. 18Paragraph 18
  344. 19Paragraph 19
  345. 20Paragraph 20
  346. 21Paragraph 21
  347. 22Paragraph 22
  348. 23Paragraph 23
  349. 24Paragraph 24
  350. 25Paragraph 25
  351. 26Paragraph 26
  352. 27Paragraph 27
  353. 28Paragraph 28
  354. 29Paragraph 29
  355. 30Paragraph 30
  356. 31Paragraph 31
  357. 32Victims and Prisoners Act 2024
  358. Schedule 12: Storing information in the terminal equipment of a subscriber or user
  359. Schedule 13: Privacy and electronic communications: Commissioner’s enforcement powers
  360. Schedule 14: The Information Commission
  361. 1Schedule 12A to the Data Protection Act 2018
  362. 2Transitional provision: first chair
  363. 3Transitional provision: consultation about non-executive members
  364. 4Transitional provision: consultation about interim chief executive
  365. Schedule 15: Information standards for health and adult social care in England
  366. 1Paragraph 1
  367. 2Paragraph 2
  368. 3Paragraph 3
  369. 4Paragraph 4
  370. 5Paragraph 5
  371. 6Paragraph 6
  372. 7Paragraph 7
  373. 8Paragraph 8
  374. Schedule 16: Grant of smart meter communication licences
  375. Part 1: Amendments of the Energy Act 2008
  376. 1Paragraph 1
  377. 2Paragraph 2
  378. 3Paragraph 3
  379. 4Paragraph 4
  380. Part 2: Amendments of other legislation Not yet in force
  381. 5Gas Act 1986 Not yet in force
  382. 6Electricity Act 1989 Not yet in force
  383. 7Electricity and Gas (Competitive Tenders for Smart Meter Communication Licences) Regulations 2012 Not yet in force