Data (Use And Access) Act 2025

Annex A – Territorial extent and application in the United Kingdom

Subject matter and legislative competence of devolved legislatures

Access to customer data and business data

1263. Part 1 of the Act, so far as it relates to the supply or provision of goods, services and digital content to a consumer, falls within the consumer protection reservation in Section C7 of Schedule 5 to the Scotland Act 1998 and Section C6 of Schedule 7A to the Government of Wales Act 2006 as relating to the regulation of the sale and supply of goods and services to consumers. These reservations do not apply in relation to the potential regulation under Part 1 of the supply or provision of goods, services or digital to business customers.
1264. The power in section 12 (levy) to impose, or provide for a specified public authority to impose, a levy is a tax-raising power and is therefore reserved as respects Scotland and Wales under the fiscal, economic and monetary policy reservations in Sections A1 of Schedules 5 and 7A to those Acts.
1265. The financial services sector sections 14 to 17 relate to financial services and are therefore reserved as respects Scotland and Wales under the financial services reservations in Sections A3 of those Schedules. Those sections also fall under the financial services reservation in paragraph 23 of Schedule 3 to the Northern Ireland Act 1998.
1266. The subject matter of Part 1 is otherwise devolved.

Digital Verification Services

1267. The internet services reservation in relation to Scotland, Wales and Northern Ireland applies to digital verification services.
1268. These sections regulate the provision of digital verification services, where providers of those services wish to appear on a government register, through the creation of a trust framework, supplementary codes, a register of providers, an information gateway and a trust mark. The provision of digital verification services will be online, though they can be used by individuals across the UK online as well as in person. The reservation of internet services applies in Northern Ireland, Wales and Scotland.
1269. Whilst the majority of the sections fall within the internet services reservation, section 47 and section 48 are provisions which have been included to protect the confidential nature of information held by the Welsh Revenue Authority and Revenue Scotland, a devolved purpose. As such, these fall within the legislative competence of the Welsh and Scottish Parliaments respectively. It is agreed that sections 45 and 49(3) modify the executive competence of Devolved Welsh Authorities.

National Underground Asset Register

1270. Legislative competence as it relates to Wales for the subject matter of Part 3 of the New Roads and Street Works Act 1991 (transport and street works) ("NRSWA 1991") is devolved to Wales. These provisions make amendments to NRSWA 1991 (including Part 3) in relation to this devolved subject matter. The relevant legislation for Northen Ireland is the Street Works (Northern Ireland) Order 1995 ("SWNIO 1995 "). Similarly, these measures make amendments to this Order, dealing with the transferred matter of transport and street works.
1271. The effective implementation and operation of NUAR will require the Secretary of State to exercise a range of functions, including a number of regulation-making powers. These will comprise a combination of existing powers, already found in the relevant legislation, and new powers inserted by this Act. Some of these existing powers in the relevant legislation are, at present, solely conferred on the Welsh Ministers or the Northern Ireland Executive (in relation to Wales or Northern Ireland, as the case may be).
1272. The NUAR provisions in the Act will make some of these existing powers, which are solely exercisable by the Welsh Ministers or the Department for Infrastructure in Northern Ireland (as the case may be), concurrently exercisable with the Secretary of State; this is to reflect that these existing powers will be used by the Secretary of State to implement NUAR, but could also be used for other purposes by the relevant devolved administration ("mixed purposes powers"). The provisions will also confer some new mixed purposes powers on the Secretary of State; provision is also made for these new mixed purpose powers to be concurrently exercisable by the Welsh Ministers and Department for Infrastructure for Northern Ireland. The NUAR provisions also remove existing (but uncommenced) powers from the Welsh Ministers and the Department for Infrastructure in Northern Ireland. This is in parallel with such powers also being removed from the Secretary of State in relation to England; the removal of these specific (and uncommenced) powers from all parties is the consequence of the underlying (and uncommenced) duty imposed on undertakers, to which those powers relate, being removed from NRSWA 1991 by these provisions.

Registers of Births and Deaths

1273. Legislative competence for births and deaths (and civil registration generally) is devolved to Scotland and Northern Ireland and separate legislation exists to govern the registration of births and deaths in those jurisdictions. Legislative competence in respect of civil registration is not devolved in Wales.
1274. The sections which amend the Births and Deaths Registration Act 1953 and the Registration Service Act 1953, relating to the form in which registers are to be kept and the provision of equipment and facilities by local authorities, extend and apply to England and Wales only.
1275. These provisions also give effect to minor and consequential amendments which do not change the application of the law in Scotland and Northern Ireland, but the extent of some of the provisions amended extend to Scotland and Northern Ireland.

Data protection

1276. The data protection reservations in relation to Scotland, Wales and Northern Ireland apply for the data protection provisions in Chapter 1 of Part 5 and provisions in relation to the Information Commission in Part 6.

Privacy and Electronic Communications

1277. The telecommunications reservations in relation to Scotland, Wales and Northern Ireland apply to changes to the Privacy and Electronic Communications (EC Directive) Regulations 2003.

Information standards for health and social care

1278. The territorial extent of these provisions is England and Wales only. The legislation applies to persons involved in marketing, supplying, providing or otherwise making available information technology, an information technology service or an information processing service using information technology in so far as it is used or intended for use in connection with the provision in, or in relation to, England of health care or adult social care.

Smart meter communication services

1279. The smart meter communication services measure extends to England, Wales and Scotland. The subject matter of the Act is reserved under the Scottish and Welsh devolution settlements.

Information to improve public service delivery

1280. The territorial extent and application of these provisions is UK-wide. Like section 35 of the Digital Economy Act 2017 (DEA 2017), this provision will extend and apply to the UK (though the powers in Part 5, Chapter 1 of the DEA 2017 have yet to be commenced in Northern Ireland).
1281. There is no relevant reservation for the power in this provision. The section relates to public service delivery to businesses which is not solely for reserved purposes but also for devolved purposes, such as providing devolved public services to businesses. This section alters the executive competence of the Devolved Administrations by extending the scope of their regulation-making powers. It does this by widening the conditions with which an objective must comply in order to meet the definition of an information-sharing "specified objective" to improve public service delivery under section 35 (9) – (12) of the DEA 2017 by adding public service delivered to businesses.

Retention of information by providers of internet services

1282. This provision relates to the reserved matter of internet services and, in Scotland, conferring functions on the Office of Communications.

Information for research about online safety matters

1283. These provisions relate to the reserved matter of internet services.

Retention of biometric data

1284. These provisions relate to the reserved or excepted matters of national security and, to the relevant extent, counter-terrorism.

Trust Services

1285. The technical standards reservation applies in Wales, Scotland and Northern Ireland.

Powers relating to verification of identity or status

1286. The immigration reservation applies in Wales, Scotland and Northern Ireland.

Creation/requesting of purported intimate images

1287. In respect of the offences themselves, the "listed categories of offences" restriction applies in Wales. In respect of the amendments to the Sentencing Act 2020, the "sentencing" reservation applies in Wales. In respect of the amendments to the Armed Forces Act 2006, the "armed forces" excepted matter applies in Northern Ireland and the defence reservations apply in Scotland and Wales. In respect of the amendment to the Serious Crime Act 2007, the "listed categories of offences" restriction applies in Wales, and the amendment extends, but does not apply, to Northern Ireland.