Part 1

Access to customer data and business data

Data regulations

Power to make provision in connection with customer data
2
1
The Secretary of State or the Treasury may by regulations make provision requiring a data holder to provide customer data—
a
to the customer, at the customer’s request, or
b
to a person of a specified description who is authorised by the customer to receive the data (an “authorised person”), at the customer’s request or at the authorised person’s request.
2
In this Part, in relation to customer data, “third party recipient” means a person of a description specified by provision made under subsection (1)(b) (and see section 25(1)).
3
The Secretary of State or the Treasury may by regulations make provision enabling or requiring a data holder—
a
to produce, collect or retain, or arrange for the production, collection or retention of, customer data;
b
to make changes to customer data, including to require rectification of inaccurate customer data, at the request of a customer or authorised person.
4
The Secretary of State or the Treasury may by regulations make provision for a person who is an authorised person in relation to customer data to take, on the customer’s behalf, action that the customer could take in relation to goods, services or digital content supplied or provided by a person who is, or has been, a data holder in relation to the customer data.
5
In deciding whether to make regulations under this section, the Secretary of State or the Treasury must have regard to (among other things)—
a
the likely effects for existing and future customers,
b
the likely effects for data holders,
c
the likely effect on small businesses and micro businesses,
d
the likely effect on innovation in the supply or provision of goods, services and digital content affected by the regulations or other goods, services and digital content, and
e
the likely effect on competition in markets for goods, services and digital content affected by the regulations or other markets.
S. 2 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)
S. 2 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904, reg. 2(a)