Data (Use and Access) Act 2025
Data (Use and Access) Act 2025 (2025 c. 18)
- Data (Use and Access) Act 2025 (2025 c. 18)
- Part 1 Access to customer data and business data
- Introductory
- 1 Customer data and business data
- Data regulations
- 2 Power to make provision in connection with customer data
- 3 Customer data: supplementary
- 4 Power to make provision in connection with business data
- 5 Business data: supplementary
- 6 Decision-makers
- 7 Interface bodies
- Enforcement
- 8 Enforcement of regulations under this Part
- 9 Restrictions on powers of investigation etc
- 10 Financial penalties
- Fees etc and financial assistance
- 11 Fees
- 12 Levy
- 13 Financial assistance
- Financial services sector
- 14 The FCA and financial services interfaces
- 15 The FCA and financial services interfaces: supplementary
- 16 The FCA and financial services interfaces: penalties and levies
- 17 The FCA and co-ordination with other regulators
- Supplementary
- 18 Liability in damages
- 19 Duty to review regulations
- 20 Restrictions on processing and data protection
- 21 Regulations under this Part: supplementary
- 22 Regulations under this Part: Parliamentary procedure and consultation
- 23 Related subordinate legislation
- 24 Repeal of provisions relating to supply of customer data
- 25 Other defined terms
- 26 Index of defined terms for this Part
- Part 2 Digital verification services
- Introductory
- 27 Introductory
- DVS trust framework and supplementary codes
- 28 DVS trust framework
- 29 Supplementary codes
- 30 Withdrawal of a supplementary code
- 31 Review of DVS trust framework and supplementary codes
- DVS register
- 32 DVS register
- 33 Registration in the DVS register
- 34 Power to refuse registration in the DVS register
- 35 Registration of additional services
- 36 Supplementary notes
- 37 Addition of services to supplementary notes
- 38 Applications for registration, supplementary notes, etc
- 39 Fees for applications for registration, supplementary notes, etc
- 40 Duty to remove person from the DVS register
- 41 Power to remove person from the DVS register
- 42 Duty to remove services from the DVS register
- 43 Duty to remove supplementary notes from the DVS register
- 44 Duty to remove services from supplementary notes
- Information gateway
- 45 Power of public authority to disclose information to registered person
- 46 Information disclosed by the Revenue and Customs
- 47 Information disclosed by the Welsh Revenue Authority
- 48 Information disclosed by Revenue Scotland
- 49 Code of practice about the disclosure of information
- Trust mark
- 50 Trust mark for use by registered persons
- Supplementary
- 51 Power of Secretary of State to require information
- 52 Arrangements for third party to exercise functions
- 53 Report on the operation of this Part
- 54 Index of defined terms for this Part
- 55 Powers relating to verification of identity or status
- Part 3 National Underground Asset Register
- 56 National Underground Asset Register: England and Wales
- 57 Information in relation to apparatus: England and Wales
- 58 National Underground Asset Register: Northern Ireland
- 59 Information in relation to apparatus: Northern Ireland
- 60 Pre-commencement consultation
- Part 4 Registers of births and deaths
- 61 Form in which registers of births and deaths are to be kept
- 62 Provision of equipment and facilities by local authorities
- 63 Requirements to sign register
- 64 Treatment of existing registers and records
- 65 Minor and consequential amendments
- Part 5 Data protection and privacy
- Chapter 1 Data protection
- Terms used in this Chapter
- 66 The 2018 Act and the UK GDPR
- Definitions in the UK GDPR and the 2018 Act
- 67 Meaning of research and statistical purposes
- 68 Consent to processing for the purposes of scientific research
- 69 Consent to law enforcement processing
- Data protection principles
- 70 Lawfulness of processing
- 71 The purpose limitation
- 72 Processing in reliance on relevant international law
- Processing of special categories of personal data
- 73 Elected representatives responding to requests
- 74 Processing of special categories of personal data
- Data subject’s rights
- 75 Fees and reasons for responses to data subjects’ requests about law enforcement processing
- 76 Time limits for responding to data subjects’ requests
- 77 Information to be provided to data subjects
- 78 Searches in response to data subjects’ requests
- 79 Data subjects’ rights to information: legal professional privilege exemption
- Automated decision-making
- 80 Automated decision-making
- Obligations of controllers
- 81 Data protection by design: children’s higher protection matters
- Logging of law enforcement processing
- 82 Logging of law enforcement processing
- Codes of conduct
- 83 General processing and codes of conduct
- 84 Law enforcement processing and codes of conduct
- International transfers of personal data
- 85 Transfers of personal data to third countries and international organisations
- Safeguards for processing for research etc purposes
- 86 Safeguards for processing for research etc purposes
- 87 Section 86: consequential provision
- National security
- 88 National security exemption
- Intelligence services
- 89 Joint processing by intelligence services and competent authorities
- 90 Joint processing: consequential amendments
- Information Commissioner’s role
- 91 Duties of the Commissioner in carrying out functions
- 92 Codes of practice for the processing of personal data
- 93 Codes of practice: panels and impact assessments
- 94 Manifestly unfounded or excessive requests to the Commissioner
- 95 Analysis of performance
- 96 Notices from the Commissioner
- Enforcement
- 97 Power of the Commissioner to require documents
- 98 Power of the Commissioner to require a report
- 99 Assessment notices: removal of OFSTED restriction
- 100 Interview notices
- 101 Penalty notices
- 102 Annual report on regulatory action
- 103 Complaints by data subjects
- 104 Court procedure in connection with subject access requests
- 105 Consequential amendments to the EITSET Regulations
- Protection of prohibitions, restrictions and data subject’s rights
- 106 Protection of prohibitions, restrictions and data subject’s rights
- Miscellaneous
- 107 Regulations under the UK GDPR
- 108 Further minor provision about data protection
- Chapter 2 Privacy and electronic communications
- 109 The PEC Regulations
- 110 Interpretation of the PEC Regulations
- 111 Duty to notify the Commissioner of personal data breach: time periods
- 112 Storing information in the terminal equipment of a subscriber or user
- 113 Emergency alerts: interpretation of time periods
- 114 Use of electronic mail for direct marketing by charities
- 115 Commissioner’s enforcement powers
- 116 Codes of conduct
- Part 6 The Information Commission
- 117 The Information Commission
- 118 Abolition of the office of Information Commissioner
- 119 Transfer of functions to the Information Commission
- 120 Transfer of property etc to the Information Commission
- Part 7 Other provision about use of, or access to, data
- Information standards for health and social care
- 121 Information standards for health and adult social care in England
- Smart meter communication services
- 122 Grant of smart meter communication licences
- Information to improve public service delivery
- 123 Disclosure of information to improve public service delivery to undertakings
- Retention of information by providers of internet services
- 124 Retention of information by providers of internet services in connection with death of child
- Information for research about online safety matters
- 125 Information for research about online safety matters
- Retention of biometric data
- 126 Retention of biometric data and recordable offences
- 127 Retention of pseudonymised biometric data
- 128 Retention of biometric data from INTERPOL
- Trust services
- 129 The eIDAS Regulation
- 130 Recognition of EU conformity assessment bodies
- 131 Removal of recognition of EU standards etc
- 132 Recognition of overseas trust products
- 133 Co-operation between supervisory authority and overseas authorities
- 134 Time periods: the eIDAS Regulation and the EITSET Regulations
- Copyright works and artificial intelligence systems
- 135 Economic impact assessment
- 136 Report on the use of copyright works in the development of AI systems
- 137 Progress statement
- Purported intimate images
- 138 Creating, or requesting the creation of, purported intimate image of adult
- Part 8 Final provisions
- 139 Power to make consequential amendments
- 140 Regulations
- 141 Extent
- 142 Commencement
- 143 Transitional, transitory and saving provision
- 144 Short title
- Schedules
- Schedule 1 National Underground Asset Register (England and Wales): monetary penalties
- Schedule 2 National Underground Asset Register (Northern Ireland): monetary penalties
- Schedule 3 Registers of births and deaths: minor and consequential amendments
- Part 1 Amendments of the Births and Deaths Registration Act 1953
- Part 2 Amendments of other legislation
- Registration Service Act 1953
- Public Records Act 1958
- Social Security Administration Act 1992
- Education Act 1996
- Adoption and Children Act 2002
- Gender Recognition Act 2004
- Presumption of Death Act 2013
- Schedule 4 Lawfulness of processing: recognised legitimate interests
- Schedule 5 Purpose limitation: processing to be treated as compatible with original purpose
- Schedule 6 Automated decision-making: minor and consequential amendments
- The UK GDPR
- The 2018 Act
- Schedule 7 Transfers of personal data to third countries etc: general processing
- Introduction
- General principles for transfers
- Transfers approved by regulations
- Transfers approved by regulations: monitoring
- Transfers subject to appropriate safeguards
- Derogations for specific situations
- Public interest restrictions
- Schedule 8 Transfers of personal data to third countries etc: law enforcement processing
- Introduction
- Overview and interpretation
- General principles for transfer
- Transfers approved by regulations
- Transfers approved by regulations: monitoring
- Transfers subject to appropriate safeguards
- Transfers based on special circumstances
- Transfers to particular recipients
- Subsequent transfers
- Schedule 9 Transfers of personal data to third countries etc: minor and consequential amendments and transitional provision
- Part 1 Minor and consequential amendments
- The UK GDPR
- The 2018 Act
- Part 2 Transitional provision
- The UK GDPR: transfers approved by regulations
- The UK GDPR: transfers subject to appropriate safeguards
- The UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses
- The UK GDPR: transfers necessary for important reasons of public interest
- The UK GDPR: restrictions on transfers of personal data to third countries and international organisations
- Part 3 of the 2018 Act (law enforcement processing): transfers approved by regulations
- Part 3 of the 2018 Act (law enforcement processing): transfers subject to appropriate safeguards
- Schedule 10 Complaints: minor and consequential amendments
- The UK GDPR
- The 2018 Act
- Schedule 11 Further minor provision about data protection
- The UK GDPR
- The 2018 Act
- Victims and Prisoners Act 2024
- Schedule 12 Storing information in the terminal equipment of a subscriber or user
- Schedule 13 Privacy and electronic communications: Commissioner’s enforcement powers
- Schedule 14 The Information Commission
- Schedule 12A to the Data Protection Act 2018
- Transitional provision: first chair
- Transitional provision: consultation about non-executive members
- Transitional provision: consultation about interim chief executive
- Schedule 15 Information standards for health and adult social care in England
- Schedule 16 Grant of smart meter communication licences
- Part 1 Amendments of the Energy Act 2008
- Part 2 Amendments of other legislation
- Gas Act 1986
- Electricity Act 1989
- Electricity and Gas (Competitive Tenders for Smart Meter Communication Licences) Regulations 2012
Feedback