Legislation – Data (Use and Access) Act 2025

New Search

Introduction

Part 1
Access to customer data and business data

1 Customer data and business data

2 Power to make provision in connection with customer data

3 Customer data: supplementary

4 Power to make provision in connection with business data

5 Business data: supplementary

6 Decision-makers

7 Interface bodies

8 Enforcement of regulations under this Part

9 Restrictions on powers of investigation etc

10 Financial penalties

11 Fees

12 Levy

13 Financial assistance

14 The FCA and financial services interfaces

15 The FCA and financial services interfaces: supplementary

16 The FCA and financial services interfaces: penalties and levies

17 The FCA and co-ordination with other regulators

18 Liability in damages

19 Duty to review regulations

20 Restrictions on processing and data protection

21 Regulations under this Part: supplementary

22 Regulations under this Part: Parliamentary procedure and consultation

23 Related subordinate legislation

24 Repeal of provisions relating to supply of customer data

25 Other defined terms

26 Index of defined terms for this Part

Part 2
Digital verification services

27 Introductory

28 DVS trust framework

29 Supplementary codes

30 Withdrawal of a supplementary code

31 Review of DVS trust framework and supplementary codes

32 DVS register

33 Registration in the DVS register

34 Power to refuse registration in the DVS register

35 Registration of additional services

36 Supplementary notes

37 Addition of services to supplementary notes

38 Applications for registration, supplementary notes, etc

39 Fees for applications for registration, supplementary notes, etc

40 Duty to remove person from the DVS register

41 Power to remove person from the DVS register

42 Duty to remove services from the DVS register

43 Duty to remove supplementary notes from the DVS register

44 Duty to remove services from supplementary notes

45 Power of public authority to disclose information to registered person

46 Information disclosed by the Revenue and Customs

47 Information disclosed by the Welsh Revenue Authority

48 Information disclosed by Revenue Scotland

49 Code of practice about the disclosure of information

50 Trust mark for use by registered persons

51 Power of Secretary of State to require information

52 Arrangements for third party to exercise functions

53 Report on the operation of this Part

54 Index of defined terms for this Part

55 Powers relating to verification of identity or status

Part 3
National Underground Asset Register

56 National Underground Asset Register: England and Wales

57 Information in relation to apparatus: England and Wales

58 National Underground Asset Register: Northern Ireland

59 Information in relation to apparatus: Northern Ireland

60 Pre-commencement consultation

Part 4
Registers of births and deaths

61 Form in which registers of births and deaths are to be kept

62 Provision of equipment and facilities by local authorities

63 Requirements to sign register

64 Treatment of existing registers and records

65 Minor and consequential amendments

Part 5
Data protection and privacy

Chapter 1 Data protection

Terms used in this Chapter

66 The 2018 Act and the UK GDPR

Definitions in the UK GDPR and the 2018 Act

67 Meaning of research and statistical purposes

68 Consent to processing for the purposes of scientific research

69 Consent to law enforcement processing

Data protection principles

70 Lawfulness of processing

71 The purpose limitation

72 Processing in reliance on relevant international law

Processing of special categories of personal data

73 Elected representatives responding to requests

74 Processing of special categories of personal data

Data subject’s rights

75 Fees and reasons for responses to data subjects’ requests about law enforcement processing

76 Time limits for responding to data subjects’ requests

77 Information to be provided to data subjects

78 Searches in response to data subjects’ requests

79 Data subjects’ rights to information: legal professional privilege exemption

Automated decision-making

80 Automated decision-making

Obligations of controllers

81 Data protection by design: children’s higher protection matters

Logging of law enforcement processing

82 Logging of law enforcement processing

Codes of conduct

83 General processing and codes of conduct

84 Law enforcement processing and codes of conduct

International transfers of personal data

85 Transfers of personal data to third countries and international organisations

Safeguards for processing for research etc purposes

86 Safeguards for processing for research etc purposes

87 Section 86: consequential provision

National security

88 National security exemption

Intelligence services

89 Joint processing by intelligence services and competent authorities

90 Joint processing: consequential amendments

Information Commissioner’s role

91 Duties of the Commissioner in carrying out functions

92 Codes of practice for the processing of personal data

93 Codes of practice: panels and impact assessments

94 Manifestly unfounded or excessive requests to the Commissioner

95 Analysis of performance

96 Notices from the Commissioner

Enforcement

97 Power of the Commissioner to require documents

98 Power of the Commissioner to require a report

99 Assessment notices: removal of OFSTED restriction

100 Interview notices

101 Penalty notices

102 Annual report on regulatory action

103 Complaints by data subjects

104 Court procedure in connection with subject access requests

105 Consequential amendments to the EITSET Regulations

Protection of prohibitions, restrictions and data subject’s rights

106 Protection of prohibitions, restrictions and data subject’s rights

Miscellaneous

107 Regulations under the UK GDPR

108 Further minor provision about data protection

Chapter 2 Privacy and electronic communications

109 The PEC Regulations

110 Interpretation of the PEC Regulations

111 Duty to notify the Commissioner of personal data breach: time periods

112 Storing information in the terminal equipment of a subscriber or user

113 Emergency alerts: interpretation of time periods

114 Use of electronic mail for direct marketing by charities

115 Commissioner’s enforcement powers

116 Codes of conduct

Part 6
The Information Commission

117 The Information Commission

118 Abolition of the office of Information Commissioner

119 Transfer of functions to the Information Commission

120 Transfer of property etc to the Information Commission

Part 7
Other provision about use of, or access to, data

121 Information standards for health and adult social care in England

122 Grant of smart meter communication licences

123 Disclosure of information to improve public service delivery to undertakings

124 Retention of information by providers of internet services in connection with death of child

125 Information for research about online safety matters

126 Retention of biometric data and recordable offences

127 Retention of pseudonymised biometric data

128 Retention of biometric data from INTERPOL

129 The eIDAS Regulation

130 Recognition of EU conformity assessment bodies

131 Removal of recognition of EU standards etc

132 Recognition of overseas trust products

133 Co-operation between supervisory authority and overseas authorities

134 Time periods: the eIDAS Regulation and the EITSET Regulations

135 Economic impact assessment

136 Report on the use of copyright works in the development of AI systems

137 Progress statement

138 Creating, or requesting the creation of, purported intimate image of adult

Part 8
Final provisions

139 Power to make consequential amendments

140 Regulations

141 Extent

142 Commencement

143 Transitional, transitory and saving provision

144 Short title

SCHEDULES

Schedule 1 National Underground Asset Register (England and Wales): monetary penalties

Schedule 2 National Underground Asset Register (Northern Ireland): monetary penalties

Schedule 3 Registers of births and deaths: minor and consequential amendments

Schedule 4 Lawfulness of processing: recognised legitimate interests

Schedule 5 Purpose limitation: processing to be treated as compatible with original purpose

Schedule 6 Automated decision-making: minor and consequential amendments

Schedule 7 Transfers of personal data to third countries etc: general processing

Schedule 8 Transfers of personal data to third countries etc: law enforcement processing

Schedule 9 Transfers of personal data to third countries etc: minor and consequential amendments and transitional provision

Schedule 10 Complaints: minor and consequential amendments

Schedule 11 Further minor provision about data protection

Schedule 12 Storing information in the terminal equipment of a subscriber or user

Schedule 13 Privacy and electronic communications: Commissioner’s enforcement powers

Schedule 14 The Information Commission

Schedule 15 Information standards for health and adult social care in England

Schedule 16 Grant of smart meter communication licences

Changes to legislation:

There are currently no known outstanding effects for the Data (Use and Access) Act 2025, Schedule 14. Help about Changes to Legislation

Close

Changes to Legislation

Revised legislation carried on this site may not be fully up to date. At the current time any known changes or effects made by subsequent legislation have been applied to the text of the legislation you are viewing by the editorial team. Please see ‘Frequently Asked Questions’ for details regarding the timescales for which new effects are identified and recorded on this site.

Schedules

Schedule 14The Information Commission

Section 117

Schedule 12A to the Data Protection Act 2018

1

In the Data Protection Act 2018, after Schedule 12 insert—

“Schedule 12AThe Information Commission

Section 114A

Status

1

(1)

The Commission is not to be regarded—

(a)

as a servant or agent of the Crown, or

(b)

as enjoying any status, immunity or privilege of the Crown.

(2)

The Commission’s property is not to be regarded—

(a)

as property of the Crown, or

(b)

as property held on behalf of the Crown.

Number of members

2

(1)

The number of members of the Commission is to be determined by the Secretary of State.

(2)

That number must not be—

(a)

less than 3, or

(b)

more than 14.

(3)

The Secretary of State may by regulations substitute a different number for the number for the time being specified in sub-paragraph (2)(b).

(4)

Regulations under this paragraph are subject to the negative resolution procedure.

Membership: general

3

(1)

The Commission is to consist of—

(a)

the non-executive members, and

(b)

the executive members.

(2)

The non-executive members are—

(a)

a chair appointed by His Majesty by Letters Patent on the recommendation of the Secretary of State, and

(b)

such other members as the Secretary of State may appoint.

(3)

The executive members are—

(a)

a chief executive appointed by the non-executive members or in accordance with paragraph 25, and

(b)

such other members, if any, as the non-executive members may appoint.

(4)

The Secretary of State must consult the chair of the Commission before appointing a non-executive member.

(5)

The non-executive members must consult the Secretary of State before appointing the chief executive.

(6)

The non-executive members must consult the chief executive about whether there should be any executive members within sub-paragraph (3)(b) and, if so, how many there should be.

(7)

The Secretary of State may by direction set a maximum and a minimum number of executive members.

(8)

The Commission may appoint one of the non-executive members as a deputy to the chair.

Membership: non-executive members to outnumber executive members

4

The Secretary of State must exercise the powers conferred on the Secretary of State by paragraphs 2 and 3 so as to secure that the number of non-executive members of the Commission is, so far as practicable, at all times greater than the number of executive members.

Membership: selection on merit etc

5

(1)

The Secretary of State may not recommend a person for appointment as the chair of the Commission unless the person has been selected on merit on the basis of fair and open competition.

(2)

A person may not be appointed as a member of the Commission unless the person has been selected on merit on the basis of fair and open competition.

Membership: conflicts of interests

6

(1)

Before—

(a)

recommending a person for appointment as the chair of the Commission, or

(b)

appointing a person as a non-executive member of the Commission,

the Secretary of State must be satisfied that the person does not have a conflict of interest.

(2)

The Secretary of State must check from time to time that none of the non-executive members has a conflict of interest.

(3)

The Secretary of State may require a non-executive member to provide whatever information the Secretary of State considers necessary for the purpose of checking that the member does not have a conflict of interest.

(4)

A non-executive member who is required to provide information under sub-paragraph (3) must provide it within such period as may be specified by the Secretary of State.

(5)

In this Schedule, “conflict of interest”, in relation to a person, means a financial or other interest which is likely to affect prejudicially the discharge by the person of the person’s functions as a member of the Commission.

Tenure of the chair

7

(1)

The chair of the Commission holds and vacates office in accordance with the terms of the chair’s appointment, subject to the provisions of this paragraph.

(2)

The chair must be appointed for a term of not more than 7 years.

(3)

On the recommendation of the Secretary of State, His Majesty may by Letters Patent extend the term of the chair’s appointment but not so the term as extended is more than 7 years.

(4)

A person cannot be appointed as the chair more than once.

(5)

The chair may be relieved from office by His Majesty at the chair’s own request.

(6)

The chair may be removed from office by His Majesty on an Address from both Houses of Parliament.

(7)

No motion is to be made in either House of Parliament for such an Address unless the Secretary of State has presented a report to that House stating that the Secretary of State is satisfied that—

(a)

the chair is guilty of serious misconduct,

(b)

the chair has a conflict of interest (see paragraph 6(5)),

(c)

the chair has failed to comply with paragraph 6(4), or

(d)

the chair is unable, unfit or unwilling to carry out the chair’s functions.

Tenure of deputy chair

8

(1)

A deputy chair of the Commission may resign that office by giving written notice to the Commission.

(2)

A deputy chair of the Commission ceases to hold that office on ceasing to be a non-executive member of the Commission.

(3)

A deputy chair of the Commission may be removed from that office by the Commission.

Tenure of the other non-executive members

9

(1)

This paragraph applies to a non-executive member of the Commission appointed by the Secretary of State.

(2)

The member holds and vacates office in accordance with the terms of their appointment, subject to the provisions of this paragraph.

(3)

The member must be appointed for a term of not more than 7 years.

(4)

The Secretary of State may extend the term of the member’s appointment but not so that the term as extended is more than 7 years.

(5)

The Secretary of State may not appoint the member as a non-executive member of the Commission on a subsequent occasion.

(6)

The member may resign from office by giving written notice to the Secretary of State and the Commission.

(7)

The Secretary of State may remove the member from office by written notice if satisfied that—

(a)

the member is guilty of serious misconduct,

(b)

the member has a conflict of interest (see paragraph 6(5)),

(c)

the member has failed to comply with paragraph 6(4), or

(d)

the member is unable, unfit or unwilling to carry out the member’s functions.

(8)

At the time of removing the member from office the Secretary of State must make public the decision to do so.

(9)

The Secretary of State must—

(a)

give the member a statement of reasons for the removal, and

(b)

if asked to do so by the member, publish the statement.

Remuneration and pensions of non-executive members

10

(1)

The Commission may pay to the non-executive members of the Commission such remuneration and allowances as the Secretary of State may determine.

(2)

The Commission may pay, or make provision for paying, to or in respect of the non-executive members of the Commission, such sums by way of pensions, allowances or gratuities (including pensions, allowances or gratuities paid by way of compensation in respect of loss of office) as the Secretary of State may determine.

(3)

The Commission may make a payment to a person of such amount as the Secretary of State may determine where—

(a)

the person ceases to be a non-executive member of the Commission otherwise than on the expiry of the person’s term of office, and

(b)

it appears to the Secretary of State that there are special circumstances which make it appropriate for the person to receive compensation.

Executive members: terms and conditions

11

(1)

The executive members of the Commission are to be employees of the Commission.

(2)

The executive members are to be employed by the Commission on such terms and conditions, including those as to remuneration, as the non-executive members of the Commission may determine.

(3)

The Commission must—

(a)

pay to or in respect of the executive members of the Commission such pensions, allowances or gratuities (including pensions, allowances or gratuities paid by way of compensation in respect of loss of office) as the non-executive members of the Commission may determine, and

(b)

provide and maintain for them such pension schemes (whether contributory or not) as the non-executive members of the Commission may determine.

Other staff: appointment, terms and conditions

12

(1)

The Commission may—

(a)

appoint other employees, and

(b)

make such other arrangements for the staffing of the Commission as it considers appropriate.

(2)

In appointing an employee, the Commission must have regard to the principle of selection on merit on the basis of fair and open competition.

(3)

Employees appointed by the Commission are to be appointed on such terms and conditions, including those as to remuneration, as the Commission may determine.

(4)

The Commission may—

(a)

pay to or in respect of those employees such pensions, allowances or gratuities (including pensions, allowances or gratuities paid by way of compensation in respect of loss of employment) as the Commission may determine, and

(b)

provide and maintain for them such pension schemes (whether contributory or not) as the Commission may determine.

Committees

13

(1)

The Commission may establish committees.

(2)

A committee of the Commission may consist of or include persons who are neither members nor employees of the Commission.

(3)

But a committee of the Commission to which functions are delegated under paragraph 14(1)(c) must include at least one person who is either a member or an employee of the Commission.

(4)

Where a person who is neither a member nor an employee of the Commission is a member of a committee of the Commission, the Commission may pay to that person such remuneration and expenses as it may determine.

Delegation of functions

14

(1)

The Commission may delegate any of its functions to—

(a)

a member of the Commission,

(b)

an employee of the Commission, or

(c)

a committee of the Commission.

(2)

A function is delegated under sub-paragraph (1) to the extent and on the terms that the Commission determines.

(3)

A committee of the Commission may delegate any function delegated to it to a member of the committee.

(4)

A function is delegated under sub-paragraph (3) to the extent and on the terms that the committee determines.

(5)

The power of a committee of the Commission to delegate a function, and to determine the extent and terms of the delegation, is subject to the Commission’s power to direct what a committee established by it may and may not do.

(6)

The delegation of a function by the Commission or a committee of the Commission under this paragraph does not prevent the Commission or the committee from exercising that function.

Advice from committees

15

The Commission may require a committee of the Commission to give the Commission advice about matters relating to the discharge of the Commission’s functions.

Proceedings

16

(1)

The Commission may make arrangements for regulating—

(a)

its own procedure, and

(b)

the procedure of a committee of the Commission.

(2)

The non-executive members of the Commission may by majority make arrangements for regulating the procedure for the carrying out of the separate functions which are conferred on them under this Schedule.

(3)

Arrangements under this paragraph may include arrangements as to quorum and the making of decisions by a majority.

(4)

The Commission must publish arrangements which it makes under this paragraph.

(5)

This paragraph is subject to paragraph 18.

Records of proceedings

17

The Commission must make arrangements for the keeping of proper records of—

(a)

its proceedings,

(b)

the proceedings of a committee of the Commission,

(c)

the proceedings at a meeting of the non-executive members of the Commission,

(d)

anything done by a member or employee of the Commission under paragraph 14(1), and

(e)

anything done by a member of a committee of the Commission under paragraph 14(3).

Disqualification for acting in relation to certain matters

18

(1)

This paragraph applies if—

(a)

a member of the Commission has a direct or indirect interest in a matter falling to be considered at a meeting of the Commission,

(b)

a non-executive member of the Commission has a direct or indirect interest in a matter falling to be considered at a meeting of the non-executive members, or

(c)

a member of a committee of the Commission has a direct or indirect interest in a matter falling to be considered at a meeting of the committee.

(2)

The member with the interest must declare it.

(3)

The declaration must be recorded in the minutes of the meeting.

(4)

The member with the interest may not take part in a discussion or decision at the meeting relating to the matter, unless—

(a)

in the case of a meeting of the Commission, the other members of the Commission who are present have resolved unanimously that the interest is to be disregarded,

(b)

in the case of a meeting of the non-executive members, the other non-executive members who are present have resolved unanimously that the interest is to be disregarded, or

(c)

in the case of a meeting of a committee, the other members of the committee who are present have, in the manner authorised by the Commission, resolved that the interest is to be disregarded.

(5)

In giving authorisation for the purposes of sub-paragraph (4)(c), the Commission must secure that a resolution for those purposes does not allow a member to take part in a discussion or decision at a meeting of a committee to which functions are delegated under paragraph 14(1)(c) unless the number of other members of the committee in favour of the resolution—

(a)

is not less than two thirds of those who are both present and entitled to vote on the resolution, and

(b)

is not less than its quorum.

(6)

For the purposes of this paragraph, a notification given at or sent to a meeting of the Commission that a person—

(a)

is a member of a company or firm, and

(b)

is to be regarded as interested in any matter involving that company or firm,

is to be regarded as compliance with sub-paragraph (2) in relation to any such matter for the purposes of that meeting and subsequent meetings of the Commission, of the non-executive members or of a committee.

(7)

For the purposes of this paragraph, a notification given at or sent to a meeting of the non-executive members of the Commission or of a committee of the Commission that—

(a)

a person is a member of a company or firm, and

(b)

is to be regarded as interested in any matter involving that company or firm,

is to be regarded as compliance with sub-paragraph (2) in relation to any such matter for the purposes of that meeting and subsequent meetings of the non-executive members or (as the case may be) of the committee.

(8)

A notification described in sub-paragraph (6) or (7) remains in force until it is withdrawn.

(9)

A person required to make a declaration for the purposes of this paragraph in relation to any meeting—

(a)

is not required to attend the meeting, but

(b)

is to be taken to have complied with the requirements of this paragraph if the person takes reasonable steps to secure that notice of the person’s interest is read out, and taken into consideration, at the meeting in question.

Validity of proceedings

19

(1)

The validity of proceedings of the Commission, of the non-executive members of the Commission or of a committee of the Commission is not affected by—

(a)

a vacancy in the membership of the Commission or of the committee,

(b)

a defect in the appointment of a member of the Commission,

(c)

a failure of the Secretary of State to comply with the requirements of paragraph 4, or

(d)

a failure to comply with arrangements under paragraph 16 or with a requirement under paragraph 18.

(2)

Nothing in sub-paragraph (1)(d) validates proceedings of a meeting which is inquorate unless it is inquorate by reason only of a matter within sub-paragraph (1)(b) or (c).

Money

20

The Secretary of State may make payments to the Commission.

Fees etc and other sums

21

(1)

All fees, charges, penalties and other sums received by the Commission in carrying out its functions are to be paid to the Secretary of State.

(2)

Sub-paragraph (1) does not apply where the Secretary of State otherwise directs.

(3)

Any sums received by the Secretary of State under this paragraph are to be paid into the Consolidated Fund.

Accounts

22

(1)

The Commission must keep proper accounts and proper records in relation to them.

(2)

The Commission must prepare a statement of accounts in respect of each financial year in the form specified by the Secretary of State.

(3)

The Commission must send a copy of each statement of accounts to the Secretary of State and the Comptroller and Auditor General before the end of August next following the financial year to which the statement relates.

(4)

The Comptroller and Auditor General must—

(a)

examine, certify and report on the statement of accounts, and

(b)

send a copy of the certified statement and the report to the Secretary of State.

(5)

The Secretary of State must lay before Parliament each document received under sub-paragraph (4)(b).

(6)

In this paragraph “financial year” means—

(a)

the period beginning with the date on which the Commission is established and ending with the 31 March following that date, and

(b)

each successive period of 12 months.

Authentication of seal and presumption of authenticity of documents

23

(1)

The application of the Commission’s seal must be authenticated by the signature of—

(a)

the chair of the Commission, or

(b)

another person authorised for that purpose by the Commission.

(2)

A document purporting to be duly executed under the Commission’s seal or signed on its behalf—

(a)

is to be received in evidence, and

(b)

is to be taken to be executed or signed in that way, unless the contrary is shown.

(3)

This paragraph does not extend to Scotland.

Supplementary powers

24

The Commission may do anything it thinks appropriate for the purposes of, or in connection with, its functions.

Transitional provision: interim chief executive

25

(1)

The first chief executive of the Commission is to be appointed by the chair of the Commission.

(2)

Before making the appointment the chair must consult the Secretary of State.

(3)

The appointment must be for a term of not more than 2 years.

(4)

The chair may extend the term of the appointment but not so the term as extended is more than 2 years.

(5)

For the term of appointment, the person appointed under sub-paragraph (1) is “the interim chief executive”.

(6)

Until the expiry of the term of appointment, the powers conferred on the non-executive members by paragraph 11(2) and (3) are exercisable in respect of the interim chief executive by the chair (instead of by the non-executive members).

(7)

In sub-paragraphs (5) and (6), the references to the term of appointment are to the term of appointment described in sub-paragraph (3), including any extension of the term under sub-paragraph (4).

Interpretation

26

In this Schedule—

(a)

references to pensions, allowances or gratuities include references to any similar benefits provided on death or retirement, and

(b)

references to the payment of pensions, allowances or gratuities to or in respect of a person include references to the making of payments towards the provision of pensions, allowances or gratuities to be paid to or in respect of a person.”

Transitional provision: first chair

2

(1)

This paragraph applies to the person who holds the office of Information Commissioner immediately before the day on which this Schedule comes into force.

(2)

The person is to be treated as having been appointed as the chair of the Information Commission for a term that expires at the time the person would cease to hold the office of Information Commissioner but for the abolition of that office by section 118.

(3)

For the purposes of paragraph 7(3) of Schedule 12A to the Data Protection Act 2018 (extension of chair’s term), the term of the person’s appointment as chair of the Information Commission is to be treated as a term beginning when the person began to hold the office of Information Commissioner.

Transitional provision: consultation about non-executive members

3

(1)

This paragraph is about the requirement under paragraph 3(4) of Schedule 12A to the Data Protection Act 2018 for the Secretary of State to consult the chair of the Information Commission before appointing a non-executive member of the Information Commission.

(2)

The requirement may be satisfied by consultation, before this Schedule comes into force, with the person who holds the office of Information Commissioner.

Transitional provision: consultation about interim chief executive

4

(1)

This paragraph is about the requirement under paragraph 25 of Schedule 12A to the Data Protection Act 2018 (transitional provision: interim chief executive) for the chair of the Information Commission to consult the Secretary of State before appointing the first chief executive of the Information Commission.

(2)

The requirement may be satisfied by consultation carried out, before this Schedule comes into force, by the person who holds the office of Information Commissioner.