Search Legislation

Advanced Search

Data (Use And Access) Act 2025

Contents

Territorial extent and application

  1. Section 141 sets out the territorial extent of the Act, that is the jurisdictions which the Act forms part of the law of. The extent of an Act can be different from its application. Application is about where an Act produces a practical effect. The territorial extent and application for measures in the Act are summarised below.
  2. See the table in Annex A for a summary of the position regarding territorial extent and application in the UK.

Access to customer data and business data

  1. The territorial extent of these provisions is UK-wide. The legislation applies to businesses operating in the UK.

Digital Verification Services

  1. The territorial extent and application of these provisions is UK-wide.

Powers relating to verification of identity or status

  1. The territorial extent of section 55 is UK-wide. Whilst the Right to Work Scheme operates UK-wide, the power to issue a civil penalty for a breach of the Right to Rent Scheme is currently in force in England only. Orders prescribing requirements under Chapter 1 of Part 3 of the Immigration Act 2014 will only have a practical effect in England, until such time as the Right to Rent Scheme is rolled out to other areas of the UK.

National Underground Asset Register

  1. Collectively, the sections relating to NUAR make equivalent provision across England, Wales and Northern Ireland. To deliver this, specific changes need to be made to legislation extending to England and Wales, and equivalent legislation extending to Northern Ireland. Sections 56, 57(1) to (7), 60(1) and Schedule 1 therefore extend to England and Wales, whilst sections 58, 59, 60(2) and Schedule 2 extend to Northern Ireland.
  2. The NUAR provisions in the Act extend to England, Wales and Northern Ireland. The Act does not make provisions for Scotland as Scotland already benefits from a system of this kind through the Scottish Community Apparatus Data Vault (VAULT), implemented by the Office of the Scottish Road Works Commissioner, which makes information about all underground pipes and cables in Scotland available from one centralised location.

Registers of Births and Deaths

  1. The sections which amend the Births and Deaths Registration Act 1953 and the Registration Service Act 1953, relating to the form in which registers are to be kept and the provision of equipment and facilities by local authorities, extend and apply to England and Wales only.
  2. These provisions also give effect to minor and consequential amendments which do not change the application of the law in Scotland and Northern Ireland, but some of the provisions amended extend to Scotland and Northern Ireland.

Data protection

  1. The Act’s amendments to the UK GDPR and DPA 2018 extend to the whole of the UK, apart from one provision relating to the Information Commission’s seal, which does not extend to Scotland. The data protection legislation amended by this Act applies to data controllers and data processors established in the UK, and those processing on their behalf, and there is some extra-territorial application for certain processing of personal data by controllers and processors established in third countries.

Privacy and Electronic Communications

  1. Changes to the Privacy and Electronic Communications (EC Directive) Regulations 2003 in Part 4 extend and apply to the whole of the UK.

Information standards for health and social care

  1. The territorial extent of these provisions is England and Wales only. The legislation applies to persons involved in marketing, supplying, providing or otherwise making available information technology, an information technology service or an information processing service using information technology in so far as it is used or intended for use in connection with the provision in, or in relation to, England of health care or adult social care.

Smart meter communication services

  1. The territorial extent and application of most of these provisions is England, Scotland and Wales.

Information to improve public service delivery

  1. The territorial extent and application of these provisions is UK-wide. Like section 35 of the Digital Economy Act 2017 (DEA 2017), this provision will extend and apply to the UK (though the powers in Part 5, Chapter 1 of the DEA 2017 have yet to be commenced in Northern Ireland).
  2. Under section 44 and section 45 of the DEA 2017, the "appropriate national authority" in relation to the information-sharing powers under section 35 (which is either the Secretary of State for Science, Innovation and Technology, Scottish Ministers, Welsh Ministers or Department of Finance in Northern Ireland) may specify an objective under section 35 which relates to individuals and households (where the relevant conditions under section 35 (9) – (12) are met).
  3. This provision allows the "appropriate national authority" to also specify objectives in relation to businesses (where the relevant conditions under section 35 (9) – (12) are met). Devolved Administrations therefore have new powers, via regulations, to specify new business-related "specified objectives" to be listed in Schedule 4 of the DEA 2017 and specify which bodies are listed in Schedule 4 of the DEA 2017 as "specified persons" having the power to share information under the "specified objectives".

Retention of information by providers of internet services

  1. This provision extends and applies to the whole of the UK. As this provision amends the Online Safety Act 2023 (OSA 2023), which applies to providers of regulated services (as defined in section 4(4) of that Act) based outside the UK, this provision applies extraterritorially in such cases also 1 .

Information for research about online safety matters

  1. These provisions extend and apply to the whole of the UK and will have extra-territorial application to the extent they apply to regulated services (as defined in section 4(2) and (4) of the OSA 2023) which are based outside the UK.

Retention of biometric data

  1. These provisions extend UK-wide but apply only to the processing of biometric material by a law enforcement authority under the law of England and Wales and Northern Ireland. A different regime applies in Scotland.

Trust services

  1. The territorial extent and application of these provisions is UK-wide

Creation/requesting of purported intimate images

  1. Section 138(1) to (3) and (6) (the new offences of creating, or requesting the creation of, purported intimate images of adults, the duties to review the operation of the ‘reasonable excuse’ defences, and amendments to the Sentencing Act 2020 in respect of deprivation orders) extend and apply to England and Wales only.
  2. Section 138(4) (amendment of the Armed Forces Act 2006 in respect of deprivation orders) extends and applies to England and Wales, Scotland and Northern Ireland, the Isle of Man, and the British overseas territories, except Gibraltar.
  3. Section 138(5) (consequential amendment of the Serious Crime Act 2007) extends to England and Wales and Northern Ireland only.

Copyright and Artificial Intelligence

  1. The territorial extent and application of these provisions is UK-wide.

1 See sections 204 and 205 of the Online Safety Act 2023.

Back to top