Data (Use And Access) Act 2025

Overview of the Act

1. This Act intends to harness the power of data for economic growth, support a modern digital government, and improve people’s lives.
2. The provisions on Smart Data schemes allow for the secure sharing of customer data, e.g., held by a communications provider or financial services provider, upon the customer’s request, with the customer themselves or authorised third-party providers (ATPs). ATPs use the customer’s data to provide services for the consumer or business, such as efficient switching and personalised market comparisons, account management, for example via account aggregation, and cross-sector user-centric control of data.
3. The Act establishes a legislative structure for the provision of digital verification services in the United Kingdom (UK), where providers of those services wish to be registered on a government register. This structure aims to enable users to recognise trusted digital identity providers within the digital identity market and enable digital identities and attributes to be used with the same confidence as paper documents. These measures make provision for the preparation and publication of a trust framework of rules concerning the provision of digital verification services, together with supplementary rules (known as supplementary codes) for specific use cases. They also establish a publicly available register of persons providing digital verification services that are certified against those rules and supplementary rules (if applicable). Finally, they provide that registered persons can use a trust mark and have access to an information gateway, to enable public authorities to disclose personal information to registered persons for identity and eligibility verification purposes.
4. The Act includes provisions which provide a legislative framework to support the operation of the National Underground Asset Register, a digital map that will improve both the efficiency and safety of underground work by providing secure access to location data about pipes, cables and other types of apparatus installed in streets.
5. The Act reforms the way in which births and deaths are registered in England and Wales, enabling the move from a paper-based system to registration in an electronic register.
6. Targeted reforms to parts of the UK's data protection and privacy framework aim to maintain high standards of protection, whilst addressing a lack of clarity in existing legislation that impedes the safe development and deployment of some new technologies. These reforms intend to support economic growth and a modern digital government.
7. The Act includes provisions facilitating the flow and use of personal data for law enforcement and national security purposes. These reforms seek to enhance the work of law enforcement and national security agencies in the interest of public security. Provisions also seek to improve law enforcement efficiency by removing unnecessary complexity and processes, and reducing differences between the data processing regimes.
8. The Act also contains provisions to reform the regulator, the Information Commissioner, including its governance structure, duties, enforcement powers, reporting requirements and its development of statutory codes of practice. These reforms give the regulator new, stronger powers and a more modern structure – while maintaining its independence.
9. The provisions on information standards for health and adult social care in England make clear that information standards published under section 250 of the Health and Social Care Act 2012 in relation to the processing of information include standards relating to information technology (IT) or IT services. The provisions extend the persons to whom information standards may apply to include providers of IT, IT services or information processing services using IT used, or intended for use, in connection with the provision in, or in relation to, England of health or adult social care.
10. The Act provides the Gas and Electricity Markets Authority flexibility to determine the best process to follow in appointing the successor licensee for providing smart meter communication services. It follows a review of the current licensing process by the Office of Gas and Electricity Markets (Ofgem), being the body that supports the Authority.
11. It also extends data sharing powers under section 35 of the Digital Economy Act 2017 to include businesses, with a view to better enabling targeted public services to support business growth and to deliver joined-up public services and reduce legal barriers to data sharing.
12. The Act makes amendments to the Online Safety Act 2023 to create a requirement for OFCOM, when notified of a child death by the Coroner (or Procurator Fiscal in Scotland) to issue an information notice to specified online service providers requiring them to retain certain information relating to the use of the service by the deceased child for a specified period.
13. The Act provides a regulation-making power to create a framework allowing researchers access to data relating to online safety held by tech companies.
14. The Act makes provision for the retention of biometric information, including that received through international partner sharing, with the intention of improving efficiency and limiting risk to national security.
15. The Act then includes provisions which seek to update regulations to make sure that the UK’s trust services legal framework continues to function effectively.