Data (Use And Access) Act 2025

Part 2: Digital Verification Services

Introductory

Section 27: Introductory

340. Section 27 sets out the scope of Part 2 of the Act and defines digital verification services (DVS).

DVS trust framework and supplementary codes

Section 28: DVS trust framework

341. Subsection (1) requires the Secretary of State to prepare and publish a DVS trust framework document (the ‘trust framework’) which sets out rules concerning the provision of DVS.
342. Subsection (2) makes clear that those rules may include the conduct of a person providing such services and that references in this Part to a person providing services in accordance with the trust framework (or similarly expressed) include compliance with the rules contained in that framework relating to that person and/or their conduct.
343. Subsection (3) requires the Secretary of State to consult the Information Commissioner and any persons the Secretary of State considers appropriate when preparing the trust framework, while subsection (4) makes clear that this consultation can take place before this section comes into force.
344. Subsection (5) enables the Secretary of State to revise and republish the trust framework following a review under section 31, or at other suitable times.
345. Subsection (6) sets out that the trust framework, or a revised version of the trust framework, must state when it will come into force, and this cannot be before the relevant trust framework is published. Subsection (7) states that the trust framework or a revised version of the trust framework can set different rules for different digital verification services, can specify that provisions come into force at different times for different purposes, and can include transitional or saving provisions.
346. Subsections (8) to (10) set out that when the trust framework is revised, provisions in the revised and republished trust framework can specify that from a particular date or from the end of a period, certificates that were issued to organisations confirming they provide services in accordance with the trust framework before the changes come into force (pre-revision certificates) do not count for specified purposes. Such provisions may specify different terms for different pre-revision certificates.

Section 29: Supplementary codes

347. Subsection (1) enables the Secretary of State to prepare and publish additional sets of rules applicable to specific DVS use cases that supplement the trust framework. Subsection (2) notes that such published sets of rules will be called ‘supplementary codes’.
348. Subsection (3) sets out that supplementary codes may include rules relating to the provision of services and to the conduct of a person providing such services. This subsection also clarifies that references in this Part to a person providing services in accordance with a supplementary code (or similarly expressed) include compliance with the rules contained in the supplementary code relating to that person and/or their conduct.
349. Subsection (4) requires the Secretary of State to consult the Information Commissioner and any persons the Secretary of State considers appropriate to consult when preparing supplementary codes. Subsection (5) sets out that this consultation can take place before this section comes into force.
350. Subsection (6) enables the Secretary of State to revise and republish supplementary codes following a review under section 31, or at other suitable times.
351. Subsection (7) sets out that a supplementary code or a revised version of a supplementary code must state when it will come into force, and this cannot be before the relevant supplementary code is published. Subsection (8) states that a supplementary code or a revised version of a supplementary code can set different rules for different digital verification services, can specify that provisions come into force at different times for different purposes, and can include transitional or saving provisions.
352. Subsections (9) to (11) set out that when a supplementary code is revised, provisions in the revised and republished supplementary code can specify that from a particular date or from the end of a period, certificates that were issued to organisations confirming they provide services in accordance with the relevant supplementary code before the changes come into force (pre-revision certificates) do not count for specified purposes. Such provisions may specify different terms for different pre-revision certificates.

Section 30: Withdrawal of a supplementary code

353. Section 30 allows the Secretary of State to make a determination to withdraw a supplementary code. Such determination must be published, and must specify when the supplementary code will be withdrawn. The specification of when the supplementary code is withdrawn must be a time after the end of 21 days following publication of the determination (starting on the day of publication).

Section 31: Review of DVS trust framework and supplementary codes

354. Section 31 sets out that the trust framework and each supplementary code should be reviewed at least every 12 months, in consultation with the Information Commissioner and any persons the Secretary of State considers appropriate to consult. Subsection (1)(b) makes it clear that this obligation does not apply to withdrawn supplementary codes.

DVS register

Section 32: DVS register

355. Subsections (1) to (3) of section 32 require the Secretary of State to establish and maintain a publicly available DVS register (‘the register’) of persons providing digital verification services.

Section 33: Registration in the DVS register

356. Subsection (1) provides that a person must be registered if they hold a certificate issued by an accredited conformity assessment body confirming they are providing DVS in accordance with the trust framework, if they have applied to be registered in respect of one or more DVS for which they have a certificate, if they have complied with the registration requirements set out in a determination made under section 38 and if they have paid any fee payable under section 39(1).
357. Subsection (2) clarifies that registration in the register under subsection (1) is subject to the Secretary of State’s power to refuse registration set out in section 34(1) and his duties to refuse registration in sections 34(10) and 41(10). Subsection (3) makes it clear that that the Secretary of State may not register a person if the requirements in subsection (1) are not met.
358. Subsection (4) also requires the Secretary of State to record on the register the services that a person is registered to provide.
359. Subsection (5) ensures that where a certificate has expired, has been withdrawn or is a pre- revision certificate required to be ignored under section 28(8), the person cannot be registered.
360. Subsections (6) and (7) are self-explanatory and define certain terms through reference to the regulation that provide the legislative framework for accreditation in the UK.

Section 34: Power to refuse registration in the DVS register

361. Subsection (1) allows the Secretary of State to refuse to register a person in the DVS register if he considers it necessary in the interests of national security or is satisfied that the organisation is not compliant with the trust framework in respect of the digital verification services that the person has applied to be registered.
362. Subsections (2) and (3) set out that the Secretary of State must inform the person being refused registration via written notice of his intention to refuse the application. That notice must state the name and address of the recipient, the reasons for removal, the right to make written representations about the intention to refuse them registration, the date by which representations should be made and, if the intention is to prevent the organisation from re-applying within a certain period the notice must specify the period proposed, noting that a person may make representations about that period.
363. Subsection (4) sets out that where the Secretary of State is intending to refuse an application on national security grounds under subsection (1)(a), the requirement to provide a person with reasons under subsection (3) does not apply if giving such reasons would be contrary to the interests of national security.
364. Subsection (5) specifies that the person must be given a minimum of 21 days beginning on the day the notice is given within which to make written representations to the Secretary of State.
365. Subsection (6) provides that the person can make oral representation if the Secretary of State considers this appropriate. The ability to make oral representations should be stated in the written notice and the notice must give the person details of how and when the oral representation can be made. Subsection (7) requires that any written or oral representations made in accordance with the written notice must be considered by the Secretary of State when making a decision on refusal of registration.
366. Subsection (8) requires the Secretary of State to give written notice to a person informing them that their application for registration has been refused.
367. Subsection (9) allows the Secretary of State to include in the notice for refusal of registration under subsection (8) a period within which any subsequent application to be registered by that person will be refused and subsection (10) requires the Secretary of State to refuse an application for registration during that period. Subsection (11) sets out that the period during which any subsequent applications to the register must be refused under subsection (9) must start on the day the notice is given and not exceed two years.

Section 35: Registration of additional services

368. Section 35 provides for registered DVS providers to apply to have their entries in the register amended to record they are providing additional services in accordance with the rules of the trust framework.
369. Subsection (1) sets out that a person may apply to register additional services in their existing entry on the register. Such an application may be made in respect of services for which the person holds a certificate issued by an accredited conformity assessment body confirming that they are providing those services in compliance with the rules of the trust framework. The application must comply with any requirements of a determination under section 38 and a fee must be paid where required by regulations made under section 39(1).
370. Subsection (2) requires the Secretary of State to amend the DVS register to record the additional services if the requirements in subsection (1) are met. Subsection (3) clarifies that that the Secretary of State may not register additional services if the conditions in subsection (1) are not met.
371. Subsection (4) ensures that where a certificate has expired, has been withdrawn or is a pre-revision certificate required to be ignored under section 28(8), the additional services cannot be registered.

Section 36: Supplementary notes

372. Section 36 provides for a person registered in the DVS register to apply to add a supplementary note to the register, which sets out that they are providing one or more services in accordance with the rules of a supplementary code.
373. Subsection (1) sets out what needs to be done when a person wants to have a supplementary note included in the DVS register. An application to have a supplementary note included in the DVS register can only be made where the person holds a certificate issued by an accredited conformity assessment body confirming they are providing those services in accordance with a supplementary code, and must comply with any requirements of a determination under section 38 and a fee must be paid where required by regulations under section 39(1).
374. Subsections (2) and (3) require the Secretary of State to add a supplementary note in the DVS register where the requirements in subsection (1) are met, unless the supplementary code against which the application has been made has been withdrawn.
375. Subsection (4) clarifies that supplementary notes can only be added where the conditions in subsection (1) are met.
376. Subsections (5) provides that a certificate will not count if it has expired, been withdrawn, or the supplementary code to which it relates has been revised since the certificate was issued and the rules of the revised code specify that the certificate should not count. In those circumstances, the supplementary note cannot appear in the register.
377. Subsection (6) is self-explanatory.

Section 37: Addition of services to supplementary notes

378. Section 37 allows a person registered in the DVS register with supplementary notes in their register entries to apply to have their notes amended to include additional services.
379. Subsection (1) sets out what needs to be done when a person wants to have their supplementary note in the DVS register amended to record their provision of additional services. An application may be made for services for which the person holds a certificate issued by an accredited conformity assessment body confirming that they are providing those services in compliance with a supplementary code. The application must comply with any requirements of a determination under section 38 and a fee must be paid where required by regulations made under section 39(1).
380. Subsections (2) and (3) require the Secretary of State to amend the supplementary note in the register if the requirements in subsection (1) are met, unless the supplementary code against which the application has been made has been withdrawn.
381. Subsection (4) clarifies that that the Secretary of State may not amend a supplementary note if the conditions in subsection (1) are not met.
382. Subsection (5) provides that a certificate will not count if it has expired, been withdrawn, or is a pre-revision certificate required to be ignored under section 29(9).

Section 38: Applications for registration, supplementary notes, etc

383. Subsection (1) of section 38 enables the Secretary of State to determine the form and manner in which applications may be made to be registered on the DVS register, to add additional services to the DVS register, to include a supplementary note in the DVS register or to add services to a supplementary note, including the information and documents to be provided in support of an application.
384. Subsection (2) sets out that a determination can make different provisions for different purposes. Subsection (4) allows the Secretary of State to revise a determination about applications for registration. Subsections (3) and (5) require the Secretary of State to publish a determination or a revised determination under this section.

Section 39: Fees for applications for registration, supplementary notes, etc

385. Subsection (1) enables the Secretary of State to make provision in regulations regarding the payment of fees in respect of applications made under sections 33, 35, 36 or 37 for registration in the DVS register, addition of services or supplementary notes or services to supplementary notes in their entry on the DVS register, and for continued registration on the DVS register.
386. Subsection (2) clarifies that the regulations may not provide for the payment of fees to any party other than the Secretary of State.
387. Subsection (3) sets out that regulations must specify the amount of the fee to be paid, or the maximum amount at which a fee could be set, or provide for the fee or its maximum amount to be determined as set out in regulations.
388. Subsection (4) provides that the fees can be set at a level higher than the administrative costs of determining an application or the administrative costs associated with continued registration. This is so that fees may cover operating costs of the DVS framework.
389. Subsection (5) is a non-exhaustive list of the types of provisions the regulations made under subsection (1) may include, such as the timing of fees, the manner in which fees must be paid, the existence of discounts and exceptions to the requirement to pay a fee, if applicable, conditions on the refund of fees, and interest payable on unpaid fees. It also confirms that regulations made under subsection (1) may include provisions on conferring functions to the Secretary of State on all the mentioned items with the exception of interest payable on unpaid fees.
390. Subsection (6) sets out that fees payable for continued registration and interest on unpaid fees is recoverable summarily, or recoverable in Scotland, as a civil debt.
391. Subsection (7) sets out that the regulations made under subsection (1) can make different provisions for different purposes, and may make transitional, transitory or saving provision.
392. Subsection (8) clarifies that regulations made under this section will be subject to the negative resolution procedure.

Section 40: Duty to remove person from the DVS register

393. Subsection (1) requires the Secretary of State to remove a person from the register when the person asks to be removed or stops providing all of the DVS for which they are registered, or no longer holds a certificate from an accredited conformity assessment body that certifies at least one of the DVS they provide as compliant with the trust framework.
394. Subsection (2) provides that a certificate will not count for that purpose if it has expired, has been withdrawn or is a pre-revision certificate required to be ignored under section 28(8).

Section 41: Power to remove person from the DVS register

395. Subsection (1) enables the Secretary of State to remove a person from the register in certain circumstances:
     • First, if the Secretary of State is satisfied that the person is failing to comply with the trust framework when providing one or more of the DVS for which they are registered;
     • Second, if the person has a supplementary note in the register, and the Secretary of State is satisfied that they are failing to comply with the relevant supplementary code in their provision of one or more of the DVS for which they are registered;
     • Third, if the Secretary of State is satisfied that the person has failed to provide information to the Secretary of State where a notice has been issued under section 51; or
     • Fourth, if the Secretary of State considers it necessary in the interests of national security.

396. Subsections (2) and (3) require the Secretary of State to give written notice to the person of an intention to remove them from the register. That notice must state the name and address of the recipient, the reasons for removal, the right to make written representations about the intention to remove them from the register, the date by which representations should be made and, if the intention is to prevent the person from re-applying within a certain period, the notice must specify the period proposed, noting that a person may make representations about that period.
397. Subsection (4) sets out that where the Secretary of State is intending to refuse an application on national security grounds under subsection (1)(d), the requirement to provide a person with reasons under subsection (3) does not apply if giving such reasons would be contrary to the interests of national security.
398. Subsection (5) specifies that the person has a minimum of 21 days beginning on the day the notice is given within which to make written representations to the Secretary of State.
399. Subsection (6) provides that the person can make oral representation if the Secretary of State considers this appropriate. The ability to make oral representations should be stated in the written notice and the notice must give the person details of how and when the oral representation can be made.
400. Subsection (7) requires that any written or oral representations made in accordance with the written notice must be considered by the Secretary of State when deciding whether to remove a person from the DVS register.
401. Subsection (8) requires the Secretary of State to give written notice to a person informing them they have been removed from the register.
402. Subsection (9) allows the Secretary of State to include in the notice for refusal of registration under subsection (8) a period within which any subsequent application made by the person to be re-registered will be refused and subsection (10) requires the Secretary of State to refuse an application for re-registration during that period. Subsection (11) sets out that the period during which any subsequent applications to the register must be refused under subsection (9) must start on the day the notice is given and not exceed two years.

Section 42: Duty to remove services from the DVS register

403. Subsections (1) and (2) set out that if a person asks for an amendment to reflect that they no longer provide one or more registered services if they stop providing one or more of the registered services (but not all of them), or, if they are no longer certified by an accredited conformity assessment body for all of the services for which they are registered, the Secretary of State must amend the register accordingly to remove the relevant services.
404. Subsection (3) sets out that a certificate will not count if it has expired, has been withdrawn, or is a pre-revision certificate required to be ignored under section 28(8).

Section 43: Duty to remove supplementary notes from the DVS register

405. Subsection (1) sets out that if a person with a supplementary note in the register asks for the note to be removed, if they stop providing all of the services to which the note relates, if they are no longer certified to be compliant with a supplementary code by an accredited conformity assessment body for at least one of the services in the note, or if they continue to be certified to be compliant but the relevant supplementary has been withdrawn, the Secretary of State must amend the register to remove the relevant supplementary note.
406. Subsection (2) sets out that a certificate will not count if it has expired, has been withdrawn, or is a pre-revision certificate required to be ignored under section 29(9).

Section 44: Duty to remove services from supplementary notes

407. Subsections (1) and (2) set out that if a person with a supplementary note on the DVS register asks for services listed on the note to be removed, if they stop providing one or more of the services listed on the note, or if they are no longer certified as compliant with a supplementary code by an accredited conformity assessment body for all of the services in the note, the Secretary of State must amend the register to remove the relevant service or services from the supplementary note.
408. Subsections (3) and (4) set out that a certificate will not count if it has expired or has been withdrawn or is a pre-revision certificate required to be ignored under section 29(9).

Information Gateway

Section 45: Power of public authority to disclose information to registered person

409. Subsections (1) and (2) state that a public authority may share information relating to an individual with a person registered in the DVS register, where the individual makes a request to that person to provide DVS.
410. Subsection (3) sets out that information disclosed under this section does not breach any duty of confidentiality owed by the public authority making the disclosure or any other restrictions (however imposed) relating to the disclosure of information.
411. Subsection (4) does not authorise disclosure by a public authority that would breach the data protection legislation, although the power to disclose information under this section is to be taken into account in deciding whether the disclosure would breach the data protection legislation. Similarly, it does not authorise disclosure of information which is prohibited under Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.
412. Subsection (5) makes clear that public authorities may only disclose information which they have obtained through exercising functions of a public nature.
413. Subsection (6) provides that this section does not affect any powers to disclose information that exist apart from this section.
414. Subsection (7) enables public authorities to charge fees for disclosing information to persons providing DVS.
415. Subsection (8) defines the terms "the data protection legislation" and "public authority" for the purpose of this section.

Section 46: Information disclosed by the Revenue and Customs

416. Subsections (1) and (2) set out that where HMRC have disclosed personal information to a person to enable provision of DVS for an individual under section 45, the person must not further disclose that information otherwise than for the purpose of providing DVS for the individual, without the consent of the Commissioners for HMRC.
417. Subsection (3) sets out that if a third party receives the information disclosed by HMRC to the registered person providing DVS directly or indirectly from the person to whom the information was disclosed by HMRC, the third party must not further disclose the information without consent of the Commissioners for HMRC.
418. Subsection (4) sets out that the offence of wrongful disclosure under section 19 of the Commissioners for Revenue and Customs Act 2005 applies where information is disclosed in contravention of this section.
419. Subsection (5) defines the terms "personal information" and "the Revenue and Customs" for the purpose of this section.

Section 47: Information disclosed by the Welsh Revenue Authority

420. Subsections (1) and (2) provide that where the Welsh Revenue Authority discloses personal information to a person under section 45 to enable provision of DVS for an individual, the person must not further disclose the information otherwise than for the purpose of providing DVS, without the consent of the Welsh Revenue Authority.
421. Subsection (3) sets out that if a third party receives the information disclosed by the Welsh Revenue Authority to the registered person providing DVS directly or indirectly from the person to whom the information was disclosed by the Welsh Revenue Authority, the third party must not further disclose the information without consent of the Welsh Revenue Authority.
422. Subsection (4) sets out that it is an offence to disclose information in contravention of subsections (2) and (3). Subsection (5) sets out the defences in relation to this offence - that the person charged with the offence reasonably believed that the disclosure of information was lawful, or that the information had already lawfully been made publicly available.
423. Subsection (6) sets out what punishments a person who commits an offence under subsection (4) will face. A person who commits the offence on summary conviction in England and Wales may be imprisoned for up to the maximum term available in a magistrates’ court, receive a fine, or both. A person committing the offence on summary conviction in Scotland may be imprisoned for a term of up to 12 months, or receive a fine up to the statutory maximum, or both. A person who commits the offence on summary conviction in Northern Ireland may be imprisoned for up to 6 months, or receive a fine up to the statutory maximum, or both. In all UK jurisdictions, a person who is convicted of the offence on indictment may be imprisoned for up to 2 years or receive a fine, or both.
424. Subsection (7) defines the term "personal information" for the purpose of this section.

Section 48: Information disclosed by Revenue Scotland

425. Sections (1) and (2) set out that where Revenue Scotland discloses personal information to a person under section 45 for the purpose to enable provision of DVS to an individual, that person must not further disclose that information otherwise than for the purpose of providing DVS, without the consent of Revenue Scotland.
426. Subsection (3) sets out that if a third party receives the information disclosed by Revenue Scotland to the registered person providing DVS directly or indirectly from the person to whom the information was disclosed by Revenue Scotland, the third party must not further disclose the information without consent of Revenue Scotland.
427. Subsection (4) sets out that it is an offence to disclose information in contravention of subsections (2) and (3).
428. Subsection (5) sets out the defences in relation to this offence - that the person charged with the offence reasonably believed that the disclosure of information was lawful, or that the information had already lawfully been made publicly available.
429. Subsection (6) sets out what punishments a person who commits an offence under subsection (4) will face. A person who commits the offence on summary conviction in England and Wales may be imprisoned for up to the maximum term available in a magistrates’ court, receive a fine, or both. A person committing the offence on summary conviction in Scotland may be imprisoned for a term of up to 12 months, or receive a fine up to the statutory maximum, or both. A person who commits the offence on summary conviction in Northern Ireland may be imprisoned for up to 6 months, or receive a fine up to the statutory maximum, or both. In all UK jurisdictions, a person who is convicted of the offence on indictment may be imprisoned for up to 2 years or receive a fine, or both.
430. Subsection (7) defines the term "personal information" for the purposes of this section.

Section 49: Code of practice about the disclosure of information

431. Subsection (1) sets out that the Secretary of State must prepare and publish a code of practice regarding the disclosure of information under section 45. Subsection (2) sets out that the code must be consistent with the data sharing code prepared and issued under the DPA 2018. Subsection (3) requires public authorities to have regard to the code of practice when disclosing information under section 45.
432. Subsection (4) enables the Secretary of State to revise and republish the code of practice.
433. Subsection (5) requires the Secretary of State to consult the Information Commissioner, the devolved administrations, and any persons the Secretary of State considers appropriate before preparing or revising the code of practice.
434. Subsection (6) states that the consultation exercise may be carried out before this section comes into force.
435. Subsections (7) and (8) set out that the code of practice will be subject to approval by a resolution of both Houses of Parliament before it is first published, and subject to the negative resolution procedure for every republication.
436. Subsections (9) to (11) provide definitions relevant to the section.

Trust mark

Section 50: Trust mark for use by registered persons

437. Subsection (1) provides that the Secretary of State can designate a trust mark to be used in providing or offering to provide DVS. Subsection (2) states that the Secretary of State must publish the trust mark. Subsection (3) provides that the trust mark cannot be used by organisations in the course of providing, or offering to provide DVS unless they are registered in the DVS register and section (4) states that the Secretary of State can enforce subsection (3) in civil proceedings.

Supplementary

Section 51: Power of Secretary of State to require information

438. Section 51 provides that the Secretary of State may by written notice require an accredited conformity assessment body or a person included in the DVS register to provide information that the Secretary of State reasonably requires with respect to the exercise of the Secretary of State’s functions under this Part.
439. Subsection (2) sets out that the written notice must explain why the information is required and subsection (3) makes further provision about what may be contained in the written notice.
440. Subsection (4) makes clear that the written notice must provide information about the consequences of failing to comply with the notice.
441. Subsection (5) enables the Secretary of State to cancel a written notice under this section.
442. Subsection (6) sets out that the disclosure of information requested by the Secretary of State does not breach any duty of confidence owed by the organisation disclosing information, or any other restriction on the disclosure of information.
443. Subsection (7) sets out that the disclosure of information requested by the Secretary of State must not infringe restrictions under sections 46, 47 or 48 of this Part, the data protection legislation or specified sections of the Investigatory Powers Act 2016, although the power to disclose information under this section is to be taken into account in deciding whether the disclosure would breach the data protection legislation.
444. Subsections (8) to (11) place certain limitations on the information which the Secretary of State may require the organisation to provide under a written notice. Subsection (12) defines the term "the data protection legislation" for the purpose of this section.

Section 52: Arrangements for third party to exercise functions

445. Section 52 sets out that the Secretary of State may make arrangements for a person prescribed by regulations to exercise the functions of the Secretary of State under this Part. Should such arrangements be made, references to the Secretary of State in this Part, or regulations made under this Part, must be read accordingly.
446. Subsection (2) makes clear that arrangements made under this section may provide for the Secretary of State to make payments to the person and make provision for the circumstances in which those payments are to be repaid to the Secretary of State. Subsection (3) states that regulations made under this section are subject to the affirmative procedure. Subsection (4) defines the term "relevant function" for the purposes of this section as all functions conferred by or under this Part, with the exception of the power to make regulations.
447. Subsection (5) clarifies that if arrangements are made under this section to delegate the function of charging or recovering fees to a prescribed person, such person must pay the fees to the Secretary of State unless the Secretary of State has directed otherwise.

Section 53: Report on the operation of this Part

448. Section 53 sets out that the Secretary of State must prepare and publish reports on the operation of this Part. The first report must be published within 12 months of section 28 coming into force and thereafter reports must not be published more than 12 months apart.

Section 54: Index of defined terms for this Part

449. Section 54 is self-explanatory.

Section 55: Powers relating to verification of identity or status

450. Subsections (1) to (3) of section 55 each elaborates and expands on the parameters of existing order/regulation-making powers to prescribe requirements in relation to right to work checks and documents in section 15(3) of the Immigration, Asylum and Nationality Act 2006, section 34 of the Immigration Act 2014 and paragraph 5(6)(b) and (c) of Schedule 6 to the Immigration Act 2016. The examples of the way these powers may be exercised include by making provision that specifies/prescribes documents provided to, and generated by, a person in the DVS register established under Part 2 of the Act (a DVS-registered person) and to specify/prescribe steps and checks involving the use of services by such a person. New provisions are also inserted into these order/regulation-making powers that confer powers to specify/prescribe a description of DVS-registered person whose entry in the DVS register includes a supplementary note relating to specified/prescribed services.