Data (Use and Access) Act 2025

Information for research about online safety matters U.K.

125 Information for research about online safety matters U.K.

(1) The Online Safety Act 2023 is amended in accordance with subsections (2) to (4).

(2) After section 154 insert—

“154A Information for research about online safety matters

(1) The Secretary of State may by regulations require providers of regulated services to provide information for purposes related to the carrying out of independent research into online safety matters.

(2) Regulations under this section may (for example) provide for—

(a) the making of applications by persons seeking information;

(b) the procedure to be followed in the making and determination of applications;

(c) the grounds on which applications are to be determined;

(d) the imposition of requirements described in subsection (1) to be effected by means of notices given to providers of regulated services (“researcher access notices”);

(e) the contents of researcher access notices;

(f) the procedure to be followed in the giving of researcher access notices;

(g) the form in which, and the means by which, information is to be provided;

(h) the safeguards to be applied in respect of the handling of information;

(i) the charging of fees payable by applicants for information under the regulations and by providers of regulated services;

(j) the enforcement of requirements imposed by the regulations;

(k) appeals in respect of decisions taken under the regulations.

(3) Provision about enforcement under subsection (2)(j) may include provision—

(a) about investigations (including the making of reports);

(b) conferring powers of entry, inspection and audit;

(c) imposing monetary penalties;

(d) creating offences, but such provision may not impose a penalty for an offence that is greater than a penalty of any of the descriptions mentioned in section 113.

(4) Regulations under this section—

(a) may authorise or require anything that is to be done under, or for the purposes of, the regulations to be done by an appropriate person;

(b) may confer a discretion on an appropriate person for the purposes of provision under paragraph (a);

(c) may apply (with or without modifications) other provisions of this Act.

(5) Regulations under this section may apply generally or only in relation to specified descriptions of—

(a) regulated services;

(b) persons carrying out independent research;

(c) research into online safety matters or the purposes of such research;

(d) information,

and provision made by virtue of section 224(1) in connection with this section may, in particular, make different provision for different descriptions of services, researchers, research or information.

(6) Regulations under this section may not require—

(a) processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, the duty imposed under the regulations to provide information is to be taken into account);

(b) provision of information in respect of which a claim to legal professional privilege, or (in Scotland) to confidentiality of communications, could be maintained in legal proceedings.

(7) Before making regulations under this section the Secretary of State must consult—

(a) OFCOM,

(b) the Information Commissioner,

(c) persons who appear to the Secretary of State to represent providers of regulated services,

(d) persons who appear to the Secretary of State to represent the interests of persons carrying out independent research into online safety matters, and

(e) such other persons as the Secretary of State considers appropriate.

(8) For the purposes of this section—

(a) “independent research” is research carried out other than on behalf of a provider of a regulated service;

(b) references to an “appropriate person” are references to—

(i) OFCOM, or

(ii) such other person as the Secretary of State considers appropriate to carry out functions under regulations made under this section (and the regulations may include provision establishing a body for this purpose).”

(3) In section 162 (OFCOM’s report about researchers’ access to information), omit subsections (7) to (10).

(4) In section 225 (Parliamentary procedure for regulations), for subsections (8) and (9) substitute—

“(8) A statutory instrument containing (whether alone or with other provision) the first regulations under the following provisions may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament—

(a) section 154A(1);

(b) paragraph 1(1) of Schedule 11.

(9) Any other statutory instrument containing regulations under a provision mentioned in subsection (8) is subject to annulment in pursuance of a resolution of either House of Parliament.”

(5) The requirement to consult under section 154A(7) of the Online Safety Act 2023 (as inserted by subsection (2) of this section) may be satisfied by consultation undertaken before the day on which this Act is passed.

Commencement Information

I1 S. 125 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)

I2 S. 125 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(s)