Search Legislation

Advanced Search

Data (Use and Access) Act 2025

Changes to legislation:

Data (Use and Access) Act 2025 is up to date with all changes known to be in force on or before 15 July 2025. There are changes that may be brought into force at a future date. Help about Changes to Legislation

Close

Changes to Legislation

Revised legislation carried on this site may not be fully up to date. Changes and effects are recorded by our editorial team in lists which can be found in the ‘Changes to Legislation’ area. Where those effects have yet to be applied to the text of the legislation by the editorial team they are also listed alongside the affected provisions when you open the content using the Table of Contents below.

View outstanding changes

Changes and effects yet to be applied to :

  1. Introductory Text

  2. Part 1 Access to customer data and business data

    1. Introductory

      1. 1.Customer data and business data

    2. Data regulations

      1. 2.Power to make provision in connection with customer data

      2. 3.Customer data: supplementary

      3. 4.Power to make provision in connection with business data

      4. 5.Business data: supplementary

      5. 6.Decision-makers

      6. 7.Interface bodies

    3. Enforcement

      1. 8.Enforcement of regulations under this Part

      2. 9.Restrictions on powers of investigation etc

      3. 10.Financial penalties

    4. Fees etc and financial assistance

      1. 11.Fees

      2. 12.Levy

      3. 13.Financial assistance

    5. Financial services sector

      1. 14.The FCA and financial services interfaces

      2. 15.The FCA and financial services interfaces: supplementary

      3. 16.The FCA and financial services interfaces: penalties and levies

      4. 17.The FCA and co-ordination with other regulators

    6. Supplementary

      1. 18.Liability in damages

      2. 19.Duty to review regulations

      3. 20.Restrictions on processing and data protection

      4. 21.Regulations under this Part: supplementary

      5. 22.Regulations under this Part: Parliamentary procedure and consultation

      6. 23.Related subordinate legislation

      7. 24.Repeal of provisions relating to supply of customer data

      8. 25.Other defined terms

      9. 26.Index of defined terms for this Part

  3. Part 2 Digital verification services

    1. Introductory

      1. 27.Introductory

    2. DVS trust framework and supplementary codes

      1. 28.DVS trust framework

      2. 29.Supplementary codes

      3. 30.Withdrawal of a supplementary code

      4. 31.Review of DVS trust framework and supplementary codes

    3. DVS register

      1. 32.DVS register

      2. 33.Registration in the DVS register

      3. 34.Power to refuse registration in the DVS register

      4. 35.Registration of additional services

      5. 36.Supplementary notes

      6. 37.Addition of services to supplementary notes

      7. 38.Applications for registration, supplementary notes, etc

      8. 39.Fees for applications for registration, supplementary notes, etc

      9. 40.Duty to remove person from the DVS register

      10. 41.Power to remove person from the DVS register

      11. 42.Duty to remove services from the DVS register

      12. 43.Duty to remove supplementary notes from the DVS register

      13. 44.Duty to remove services from supplementary notes

    4. Information gateway

      1. 45.Power of public authority to disclose information to registered person

      2. 46.Information disclosed by the Revenue and Customs

      3. 47.Information disclosed by the Welsh Revenue Authority

      4. 48.Information disclosed by Revenue Scotland

      5. 49.Code of practice about the disclosure of information

    5. Trust mark

      1. 50.Trust mark for use by registered persons

    6. Supplementary

      1. 51.Power of Secretary of State to require information

      2. 52.Arrangements for third party to exercise functions

      3. 53.Report on the operation of this Part

      4. 54.Index of defined terms for this Part

      5. 55.Powers relating to verification of identity or status

  4. Part 3 National Underground Asset Register

    1. 56.National Underground Asset Register: England and Wales

    2. 57.Information in relation to apparatus: England and Wales

    3. 58.National Underground Asset Register: Northern Ireland

    4. 59.Information in relation to apparatus: Northern Ireland

    5. 60.Pre-commencement consultation

  5. Part 4 Registers of births and deaths

    1. 61.Form in which registers of births and deaths are to be kept

    2. 62.Provision of equipment and facilities by local authorities

    3. 63.Requirements to sign register

    4. 64.Treatment of existing registers and records

    5. 65.Minor and consequential amendments

  6. Part 5 Data protection and privacy

    1. Chapter 1 Data protection

      1. Terms used in this Chapter

        1. 66.The 2018 Act and the UK GDPR

      2. Definitions in the UK GDPR and the 2018 Act

        1. 67.Meaning of research and statistical purposes

        2. 68.Consent to processing for the purposes of scientific research

        3. 69.Consent to law enforcement processing

      3. Data protection principles

        1. 70.Lawfulness of processing

        2. 71.The purpose limitation

        3. 72.Processing in reliance on relevant international law

      4. Processing of special categories of personal data

        1. 73.Elected representatives responding to requests

        2. 74.Processing of special categories of personal data

      5. Data subject’s rights

        1. 75.Fees and reasons for responses to data subjects’ requests about law enforcement processing

        2. 76.Time limits for responding to data subjects’ requests

        3. 77.Information to be provided to data subjects

        4. 78.Searches in response to data subjects’ requests

        5. 79.Data subjects’ rights to information: legal professional privilege exemption

      6. Automated decision-making

        1. 80.Automated decision-making

      7. Obligations of controllers

        1. 81.Data protection by design: children’s higher protection matters

      8. Logging of law enforcement processing

        1. 82.Logging of law enforcement processing

      9. Codes of conduct

        1. 83.General processing and codes of conduct

        2. 84.Law enforcement processing and codes of conduct

      10. International transfers of personal data

        1. 85.Transfers of personal data to third countries and international organisations

      11. Safeguards for processing for research etc purposes

        1. 86.Safeguards for processing for research etc purposes

        2. 87.Section 86: consequential provision

      12. National security

        1. 88.National security exemption

      13. Intelligence services

        1. 89.Joint processing by intelligence services and competent authorities

        2. 90.Joint processing: consequential amendments

      14. Information Commissioner’s role

        1. 91.Duties of the Commissioner in carrying out functions

        2. 92.Codes of practice for the processing of personal data

        3. 93.Codes of practice: panels and impact assessments

        4. 94.Manifestly unfounded or excessive requests to the Commissioner

        5. 95.Analysis of performance

        6. 96.Notices from the Commissioner

      15. Enforcement

        1. 97.Power of the Commissioner to require documents

        2. 98.Power of the Commissioner to require a report

        3. 99.Assessment notices: removal of OFSTED restriction

        4. 100.Interview notices

        5. 101.Penalty notices

        6. 102.Annual report on regulatory action

        7. 103.Complaints by data subjects

        8. 104.Court procedure in connection with subject access requests

        9. 105.Consequential amendments to the EITSET Regulations

      16. Protection of prohibitions, restrictions and data subject’s rights

        1. 106.Protection of prohibitions, restrictions and data subject’s rights

      17. Miscellaneous

        1. 107.Regulations under the UK GDPR

        2. 108.Further minor provision about data protection

    2. Chapter 2 Privacy and electronic communications

      1. 109.The PEC Regulations

      2. 110.Interpretation of the PEC Regulations

      3. 111.Duty to notify the Commissioner of personal data breach: time periods

      4. 112.Storing information in the terminal equipment of a subscriber or user

      5. 113.Emergency alerts: interpretation of time periods

      6. 114.Use of electronic mail for direct marketing by charities

      7. 115.Commissioner’s enforcement powers

      8. 116.Codes of conduct

  7. Part 6 The Information Commission

    1. 117.The Information Commission

    2. 118.Abolition of the office of Information Commissioner

    3. 119.Transfer of functions to the Information Commission

    4. 120.Transfer of property etc to the Information Commission

  8. Part 7 Other provision about use of, or access to, data

    1. Information standards for health and social care

      1. 121.Information standards for health and adult social care in England

    2. Smart meter communication services

      1. 122.Grant of smart meter communication licences

    3. Information to improve public service delivery

      1. 123.Disclosure of information to improve public service delivery to undertakings

    4. Retention of information by providers of internet services

      1. 124.Retention of information by providers of internet services in connection with death of child

    5. Information for research about online safety matters

      1. 125.Information for research about online safety matters

    6. Retention of biometric data

      1. 126.Retention of biometric data and recordable offences

      2. 127.Retention of pseudonymised biometric data

      3. 128.Retention of biometric data from INTERPOL

    7. Trust services

      1. 129.The eIDAS Regulation

      2. 130.Recognition of EU conformity assessment bodies

      3. 131.Removal of recognition of EU standards etc

      4. 132.Recognition of overseas trust products

      5. 133.Co-operation between supervisory authority and overseas authorities

      6. 134.Time periods: the eIDAS Regulation and the EITSET Regulations

    8. Copyright works and artificial intelligence systems

      1. 135.Economic impact assessment

      2. 136.Report on the use of copyright works in the development of AI systems

      3. 137.Progress statement

    9. Purported intimate images

      1. 138.Creating, or requesting the creation of, purported intimate image of adult

  9. Part 8 Final provisions

    1. 139.Power to make consequential amendments

    2. 140.Regulations

    3. 141.Extent

    4. 142.Commencement

    5. 143.Transitional, transitory and saving provision

    6. 144.Short title

  10. Schedules

    1. Schedule 1

      National Underground Asset Register (England and Wales): monetary penalties

    2. Schedule 2

      National Underground Asset Register (Northern Ireland): monetary penalties

    3. Schedule 3

      Registers of births and deaths: minor and consequential amendments

      1. Part 1 Amendments of the Births and Deaths Registration Act 1953

        1. 1.The Births and Deaths Registration Act 1953 is amended as...

        2. 2.(1) Section 3A (registration of births of abandoned children) is...

        3. 3.(1) Section 13 (registration of name of child or of...

        4. 4.In Part 3 (general), the italic heading before section 25...

        5. 5.(1) Section 29 (correction of errors in registers) is amended...

        6. 6.In section 29A (alternative procedure for certain corrections), in subsection...

        7. 7.(1) Section 30 (searches of indexes kept by Registrar General)...

        8. 8.In section 31 (searches of indexes kept by superintendent registrars),...

        9. 9.For section 32 (searches in registers kept by registrars) substitute—...

        10. 10.(1) Section 33 (short certificate of birth) is amended as...

        11. 11.In section 33A (short certificate of death), in subsection (2),...

        12. 12.In section 34 (entry in register as evidence of birth...

        13. 13.(1) Section 34A (searches and records of information: additional provision)...

        14. 14.In section 35 (offences relating to registers), in paragraph (b),...

        15. 15.In section 40 (sending and providing notices, information or other...

        16. 16.In section 41 (interpretation), after subsection (3) insert—

      2. Part 2 Amendments of other legislation

        1. 17.Registration Service Act 1953

        2. 18.In section 10 (district register offices), in subsection (1), omit...

        3. 19.In section 12 (provision of register boxes), omit “registrar of...

        4. 20.In section 13 (local schemes of organisation), in subsection (2),...

        5. 21.Public Records Act 1958

        6. 22.Social Security Administration Act 1992

        7. 23.Education Act 1996

        8. 24.Adoption and Children Act 2002

        9. 25.Gender Recognition Act 2004

        10. 26.(1) Section 10 (registration) is amended as follows.

        11. 27.In Part 1 of Schedule 3 (registration: England and Wales),...

        12. 28.Presumption of Death Act 2013

    4. Schedule 4

      Lawfulness of processing: recognised legitimate interests

    5. Schedule 5

      Purpose limitation: processing to be treated as compatible with original purpose

    6. Schedule 6

      Automated decision-making: minor and consequential amendments

      1. 1.The UK GDPR

      2. 2.(1) Article 12 (transparent information, communication and modalities for the...

      3. 3.In Article 13(2)(f) (information about automated decision-making to be provided...

      4. 4.In Article 14(2)(g) (information about automated decision-making to be provided...

      5. 5.In Article 15(1)(h) (right of access by the data subject),...

      6. 6.In the heading of Section 4 of Chapter 3, omit...

      7. 7.In Article 23(1) (restrictions), for “provided for in Articles 12...

      8. 8.In Article 47(2)(e) (binding corporate rules), for the words from...

      9. 9.In Article 83(5) (general conditions for imposing administrative fines)—

      10. 10.The 2018 Act

      11. 11.Omit section 14 (automated decision-making authorised by law: safeguards).

      12. 12.In section 43(1)(d) (overview and scope of provisions in Part...

      13. 13.(1) Section 52 (form of provision of information etc) is...

      14. 14.(1) Section 53 (manifestly unfounded or excessive requests by the...

      15. 15.In section 149(2)(b) (enforcement notices)— (a) after “provision of” insert...

      16. 16.In section 157(2)(a) (maximum amount of penalty), for “49,” substitute...

    7. Schedule 7

      Transfers of personal data to third countries etc: general processing

      1. 1.Introduction

      2. 2.General principles for transfers

      3. 3.Transfers approved by regulations

      4. 4.After that Article insert— Transfers approved by regulations (1) For the purposes of Article 44A, the Secretary of...

      5. 5.Transfers approved by regulations: monitoring

      6. 6.Transfers subject to appropriate safeguards

      7. 7.In the heading of Article 47 (binding corporate rules) at...

      8. 8.After Article 47 insert— Transfers subject to appropriate safeguards: further...

      9. 9.Derogations for specific situations

      10. 10.Public interest restrictions

    8. Schedule 8

      Transfers of personal data to third countries etc: law enforcement processing

      1. 1.Introduction

      2. 2.Overview and interpretation

      3. 3.General principles for transfer

      4. 4.Transfers approved by regulations

      5. 5.Transfers approved by regulations: monitoring

      6. 6.Transfers subject to appropriate safeguards

      7. 7.Transfers based on special circumstances

      8. 8.Transfers to particular recipients

      9. 9.(1) Section 77 (conditions for transfers of personal data to...

      10. 10.Subsequent transfers

    9. Schedule 9

      Transfers of personal data to third countries etc: minor and consequential amendments and transitional provision

      1. Part 1 Minor and consequential amendments

        1. 1.The UK GDPR

        2. 2.In Article 13(1)(f) (information to be provided where personal data...

        3. 3.In Article 14(1)(f) (information to be provided where personal data...

        4. 4.In Article 15(2) (right of access by the data subject)—...

        5. 5.(1) Article 40 (codes of conduct) is amended as follows....

        6. 6.In Article 42(2) (certification) omit “appropriate” in both places.

        7. 7.In Article 46(2)(d) (transfers subject to appropriate safeguards: standard data...

        8. 8.In Article 57(1) (Commissioner’s tasks)— (a) in point (m) omit...

        9. 9.In Article 58(3) (authorisation and advisory powers of the Commissioner),...

        10. 10.In Article 83(5)(c) (general conditions for imposing administrative fines), for...

        11. 11.The 2018 Act

        12. 12.Omit section 17A (transfers based on adequacy regulations) and the...

        13. 13.Omit section 17B (transfers based on adequacy regulations: review etc)....

        14. 14.Omit section 17C (standard data protection clauses).

        15. 15.Omit section 18 (transfers of personal data to third countries...

        16. 16.In section 24(2) (manual unstructured data held by FOI public...

        17. 17.In section 26(2) (national security and defence exemption), omit paragraph...

        18. 18.In section 75 (transfers on the basis of appropriate safeguards),...

        19. 19.In section 78A (law enforcement processing: national security exemption) (inserted...

        20. 20.(1) Section 119A (power of Commissioner to specify standard clauses...

        21. 21.In section 149(2)(e) (enforcement notices), for “44 to 49” substitute...

        22. 22.(1) Section 182 (regulations and consultation) is amended as follows....

        23. 23.In section 205(2)(e) (references to periods of time) omit “and...

        24. 24.In paragraph 26(9)(d) of Schedule 2 (exemptions etc for journalistic,...

        25. 25.(1) Part 3 of Schedule 21 (further transitional provision etc:...

      2. Part 2 Transitional provision

        1. 26.The UK GDPR: transfers approved by regulations

        2. 27.The UK GDPR: transfers subject to appropriate safeguards

        3. 28.The UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses

        4. 29.(1) This paragraph applies to a requirement for safeguards to...

        5. 30.The UK GDPR: transfers necessary for important reasons of public interest

        6. 31.The UK GDPR: restrictions on transfers of personal data to third countries and international organisations

        7. 32.Part 3 of the 2018 Act (law enforcement processing): transfers approved by regulations

        8. 33.Part 3 of the 2018 Act (law enforcement processing): transfers subject to appropriate safeguards

    10. Schedule 10

      Complaints: minor and consequential amendments

      1. 1.The UK GDPR

      2. 2.In Article 12(4) (transparent information, communication and modalities for the...

      3. 3.(1) Article 13(2) (information to be provided where personal data...

      4. 4.(1) Article 14(2) (information to be provided where personal data...

      5. 5.(1) Article 15(1) (right of access by the data subject)...

      6. 6.In Article 47 (binding corporate rules), in paragraph 2(e), for...

      7. 7.(1) Article 80 (representation of data subjects) is amended as...

      8. 8.The 2018 Act

      9. 9.In section 26(2)(f) (national security and defence exemption), omit sub-paragraph...

      10. 10.(1) Section 44 (information: controller’s general duties) is amended as...

      11. 11.(1) Section 45 (right of access by the data subject)...

      12. 12.In section 45A (exemption from sections 44 and 45: legal...

      13. 13.(1) Section 48 (rights to rectification, to erasure or to...

      14. 14.In section 93(1)(e) (right to information), after “Commissioner”, in the...

      15. 15.In section 94(2)(f) (right of access), after “Commissioner”, in the...

      16. 16.(1) Section 149 (enforcement notices) is amended as follows.

      17. 17.In section 155 (penalty notices), in subsection (1)(a), for “or...

      18. 18.In section 157 (maximum amount of penalty), after subsection (4)...

      19. 19.In section 165 (complaints by data subjects), in the heading,...

      20. 20.(1) Section 166 (orders to progress complaints) is amended as...

      21. 21.(1) Section 187 (representation of data subjects with their authority)...

    11. Schedule 11

      Further minor provision about data protection

      1. 1.The UK GDPR

      2. 2.(1) Article 4(1) (interpretation) is amended as follows.

      3. 3.After Article 4 insert— Periods of time (1) References in this Regulation to a period expressed in...

      4. 4.In Article 9 (processing of special categories of personal data)—...

      5. 5.In Article 12(5) (information etc to be provided free of...

      6. 6.In Article 23(1)(h) (restrictions), for “(a)” substitute “(c)”.

      7. 7.In Article 24(3) (responsibility of the controller), for “an element...

      8. 8.In Article 25(3) (data protection by design and by default),...

      9. 9.In Article 28(5) (processors), for “an element by which to...

      10. 10.In Article 32(3) (security of processing), for “an element by...

      11. 11.In Article 37(1)(a), after “courts” insert “and tribunals”.

      12. 12.Omit Article 59 (activity reports).

      13. 13.The 2018 Act

      14. 14.In section 3(9) (definition of “the data protection legislation”)—

      15. 15.Omit section 20 (meaning of “court” in Part 2).

      16. 16.In section 94 (data subject’s right of access under Part...

      17. 17.In section 119A(11) (standard clauses for transfers to third countries...

      18. 18.In section 124(5) (data protection and journalism code), in the...

      19. 19.(1) Section 125 (approval of codes of practice prepared by...

      20. 20.In section 139 (reporting to Parliament), omit subsection (2).

      21. 21.In section 161(6) (approval of first guidance about regulatory action),...

      22. 22.In section 170(2)(a) (unlawful obtaining etc of personal data), after...

      23. 23.(1) Section 171 (re-identification of de-identified personal data) is amended...

      24. 24.In section 181 (interpretation of Part 6) omit the definition...

      25. 25.In section 184(4) (prohibition of requirement to produce relevant records),...

      26. 26.In section 192(6) (approval of the Framework), after “any” insert...

      27. 27.In section 206 (index of defined expressions), in the Table,...

      28. 28.(1) Schedule 1 (special categories of personal data and criminal...

      29. 29.(1) Schedule 2 (exemptions etc from the UK GDPR) is...

      30. 30.In paragraph 8(1)(b) of Schedule 8 (conditions for sensitive processing...

      31. 31.In paragraph 2(a) of Schedule 11 (other exemptions under Part...

      32. 32.Victims and Prisoners Act 2024

    12. Schedule 12

      Storing information in the terminal equipment of a subscriber or user

    13. Schedule 13

      Privacy and electronic communications: Commissioner’s enforcement powers

    14. Schedule 14

      The Information Commission

      1. 1.Schedule 12A to the Data Protection Act 2018

      2. 2.Transitional provision: first chair

      3. 3.Transitional provision: consultation about non-executive members

      4. 4.Transitional provision: consultation about interim chief executive

    15. Schedule 15

      Information standards for health and adult social care in England

      1. 1.Chapter 1 of Part 9 of the Health and Social...

      2. 2.Before section 250 insert— Powers to publish standards .

      3. 3.(1) Section 250 (powers to publish information standards) is amended...

      4. 4.After section 250 insert— Standards relating to information technology (1) An information standard relating to information technology or IT...

      5. 5.(1) Section 251 (information standards: procedure etc) is amended as...

      6. 6.After section 251 insert— Compliance with standards .

      7. 7.For the heading of section 251ZA (information standards: compliance) substitute...

      8. 8.After that section insert— Notice requesting compliance by relevant IT...

    16. Schedule 16

      Grant of smart meter communication licences

      1. Part 1 Amendments of the Energy Act 2008

        1. 1.The Energy Act 2008 is amended as follows.

        2. 2.In the italic heading before section 88, after “meters” insert...

        3. 3.After section 91 insert— Grant of smart meter communication licences...

        4. 4.In section 104 (subordinate legislation)— (a) in subsection (1), for...

      2. Part 2 Amendments of other legislation

        1. 5.Gas Act 1986

        2. 6.Electricity Act 1989

        3. 7.Electricity and Gas (Competitive Tenders for Smart Meter Communication Licences) Regulations 2012

Back to top

Options/Help

Print Options

You have chosen to open The Whole Act

The Whole Act you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.

Would you like to continue?

You have chosen to open The Whole Act as a PDF

The Whole Act you have selected contains over 200 provisions and might take some time to download.

Would you like to continue?

You have chosen to open the Whole Act

The Whole Act you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.

Would you like to continue?

You have chosen to open the Whole Act without Schedules

The Whole Act without Schedules you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.

Would you like to continue?

You have chosen to open Schedules only

The Schedules you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.

Would you like to continue?

Close

Legislation is available in different versions:

Latest Available (revised):The latest available updated version of the legislation incorporating changes made by subsequent legislation and applied by our editorial team. Changes we have not yet applied to the text, can be found in the ‘Changes to Legislation’ area.

Original (As Enacted or Made): The original version of the legislation as it stood when it was enacted or made. No changes have been applied to the text.

Close

Opening Options

Different options to open legislation in order to view more content on screen at once

Close

More Resources

Access essential accompanying documents and information for this legislation item from this tab. Dependent on the legislation item being viewed this may include:

  • the original print PDF of the as enacted version that was used for the print copy
  • lists of changes made by and/or affecting this legislation item
  • confers power and blanket amendment details
  • all formats of all associated documents
  • correction slips
  • links to related legislation and further information resources
Close

Timeline of Changes

This timeline shows the different points in time where a change occurred. The dates will coincide with the earliest date on which the change (e.g an insertion, a repeal or a substitution) that was applied came into force. The first date in the timeline will usually be the earliest date when the provision came into force. In some cases the first date is 01/02/1991 (or for Northern Ireland legislation 01/01/2006). This date is our basedate. No versions before this date are available. For further information see the Editorial Practice Guide and Glossary under Help.

Close

More Resources

Use this menu to access essential accompanying documents and information for this legislation item. Dependent on the legislation item being viewed this may include:

  • the original print PDF of the as enacted version that was used for the print copy
  • correction slips

Click 'View More' or select 'More Resources' tab for additional information including:

  • lists of changes made by and/or affecting this legislation item
  • confers power and blanket amendment details
  • all formats of all associated documents
  • links to related legislation and further information resources

The data on this page is available in the alternative data formats listed: