Legislation – Data (Use and Access) Act 2025

New Search

Introduction

Part 1
Access to customer data and business data

1 Customer data and business data

2 Power to make provision in connection with customer data

3 Customer data: supplementary

4 Power to make provision in connection with business data

5 Business data: supplementary

6 Decision-makers

7 Interface bodies

8 Enforcement of regulations under this Part

9 Restrictions on powers of investigation etc

10 Financial penalties

11 Fees

12 Levy

13 Financial assistance

14 The FCA and financial services interfaces

15 The FCA and financial services interfaces: supplementary

16 The FCA and financial services interfaces: penalties and levies

17 The FCA and co-ordination with other regulators

18 Liability in damages

19 Duty to review regulations

20 Restrictions on processing and data protection

21 Regulations under this Part: supplementary

22 Regulations under this Part: Parliamentary procedure and consultation

23 Related subordinate legislation

24 Repeal of provisions relating to supply of customer data

25 Other defined terms

26 Index of defined terms for this Part

Part 2
Digital verification services

27 Introductory

28 DVS trust framework

29 Supplementary codes

30 Withdrawal of a supplementary code

31 Review of DVS trust framework and supplementary codes

32 DVS register

33 Registration in the DVS register

34 Power to refuse registration in the DVS register

35 Registration of additional services

36 Supplementary notes

37 Addition of services to supplementary notes

38 Applications for registration, supplementary notes, etc

39 Fees for applications for registration, supplementary notes, etc

40 Duty to remove person from the DVS register

41 Power to remove person from the DVS register

42 Duty to remove services from the DVS register

43 Duty to remove supplementary notes from the DVS register

44 Duty to remove services from supplementary notes

45 Power of public authority to disclose information to registered person

46 Information disclosed by the Revenue and Customs

47 Information disclosed by the Welsh Revenue Authority

48 Information disclosed by Revenue Scotland

49 Code of practice about the disclosure of information

50 Trust mark for use by registered persons

51 Power of Secretary of State to require information

52 Arrangements for third party to exercise functions

53 Report on the operation of this Part

54 Index of defined terms for this Part

55 Powers relating to verification of identity or status

Part 3
National Underground Asset Register

56 National Underground Asset Register: England and Wales

57 Information in relation to apparatus: England and Wales

58 National Underground Asset Register: Northern Ireland

59 Information in relation to apparatus: Northern Ireland

60 Pre-commencement consultation

Part 4
Registers of births and deaths

61 Form in which registers of births and deaths are to be kept

62 Provision of equipment and facilities by local authorities

63 Requirements to sign register

64 Treatment of existing registers and records

65 Minor and consequential amendments

Part 5
Data protection and privacy

Chapter 1 Data protection

Terms used in this Chapter

66 The 2018 Act and the UK GDPR

Definitions in the UK GDPR and the 2018 Act

67 Meaning of research and statistical purposes

68 Consent to processing for the purposes of scientific research

69 Consent to law enforcement processing

Data protection principles

70 Lawfulness of processing

71 The purpose limitation

72 Processing in reliance on relevant international law

Processing of special categories of personal data

73 Elected representatives responding to requests

74 Processing of special categories of personal data

Data subject’s rights

75 Fees and reasons for responses to data subjects’ requests about law enforcement processing

76 Time limits for responding to data subjects’ requests

77 Information to be provided to data subjects

78 Searches in response to data subjects’ requests

79 Data subjects’ rights to information: legal professional privilege exemption

Automated decision-making

80 Automated decision-making

Obligations of controllers

81 Data protection by design: children’s higher protection matters

Logging of law enforcement processing

82 Logging of law enforcement processing

Codes of conduct

83 General processing and codes of conduct

84 Law enforcement processing and codes of conduct

International transfers of personal data

85 Transfers of personal data to third countries and international organisations

Safeguards for processing for research etc purposes

86 Safeguards for processing for research etc purposes

87 Section 86: consequential provision

National security

88 National security exemption

Intelligence services

89 Joint processing by intelligence services and competent authorities

90 Joint processing: consequential amendments

Information Commissioner’s role

91 Duties of the Commissioner in carrying out functions

92 Codes of practice for the processing of personal data

93 Codes of practice: panels and impact assessments

94 Manifestly unfounded or excessive requests to the Commissioner

95 Analysis of performance

96 Notices from the Commissioner

Enforcement

97 Power of the Commissioner to require documents

98 Power of the Commissioner to require a report

99 Assessment notices: removal of OFSTED restriction

100 Interview notices

101 Penalty notices

102 Annual report on regulatory action

103 Complaints by data subjects

104 Court procedure in connection with subject access requests

105 Consequential amendments to the EITSET Regulations

Protection of prohibitions, restrictions and data subject’s rights

106 Protection of prohibitions, restrictions and data subject’s rights

Miscellaneous

107 Regulations under the UK GDPR

108 Further minor provision about data protection

Chapter 2 Privacy and electronic communications

109 The PEC Regulations

110 Interpretation of the PEC Regulations

111 Duty to notify the Commissioner of personal data breach: time periods

112 Storing information in the terminal equipment of a subscriber or user

113 Emergency alerts: interpretation of time periods

114 Use of electronic mail for direct marketing by charities

115 Commissioner’s enforcement powers

116 Codes of conduct

Part 6
The Information Commission

117 The Information Commission

118 Abolition of the office of Information Commissioner

119 Transfer of functions to the Information Commission

120 Transfer of property etc to the Information Commission

Part 7
Other provision about use of, or access to, data

121 Information standards for health and adult social care in England

122 Grant of smart meter communication licences

123 Disclosure of information to improve public service delivery to undertakings

124 Retention of information by providers of internet services in connection with death of child

125 Information for research about online safety matters

126 Retention of biometric data and recordable offences

127 Retention of pseudonymised biometric data

128 Retention of biometric data from INTERPOL

129 The eIDAS Regulation

130 Recognition of EU conformity assessment bodies

131 Removal of recognition of EU standards etc

132 Recognition of overseas trust products

133 Co-operation between supervisory authority and overseas authorities

134 Time periods: the eIDAS Regulation and the EITSET Regulations

135 Economic impact assessment

136 Report on the use of copyright works in the development of AI systems

137 Progress statement

138 Creating, or requesting the creation of, purported intimate image of adult

Part 8
Final provisions

139 Power to make consequential amendments

140 Regulations

141 Extent

142 Commencement

143 Transitional, transitory and saving provision

144 Short title

SCHEDULES

Schedule 1 National Underground Asset Register (England and Wales): monetary penalties

Schedule 2 National Underground Asset Register (Northern Ireland): monetary penalties

Schedule 3 Registers of births and deaths: minor and consequential amendments

Schedule 4 Lawfulness of processing: recognised legitimate interests

Schedule 5 Purpose limitation: processing to be treated as compatible with original purpose

Schedule 6 Automated decision-making: minor and consequential amendments

Schedule 7 Transfers of personal data to third countries etc: general processing

Schedule 8 Transfers of personal data to third countries etc: law enforcement processing

Schedule 9 Transfers of personal data to third countries etc: minor and consequential amendments and transitional provision

Schedule 10 Complaints: minor and consequential amendments

Schedule 11 Further minor provision about data protection

Schedule 12 Storing information in the terminal equipment of a subscriber or user

Schedule 13 Privacy and electronic communications: Commissioner’s enforcement powers

Schedule 14 The Information Commission

Schedule 15 Information standards for health and adult social care in England

Schedule 16 Grant of smart meter communication licences

Schedules

Schedule 16Grant of smart meter communication licences

Section 122

Part 1Amendments of the Energy Act 2008

1

The Energy Act 2008 is amended as follows.

2

In the italic heading before section 88, after “meters” insert “: modification of licence conditions etc by Secretary of State”.

3

After section 91 insert—

“Grant of smart meter communication licences

91AGrant of smart meter communication licences

(1)

The Gas and Electricity Markets Authority may by regulations make provision about the procedure to be followed in relation to the grant of a smart meter communication licence.

(2)

Regulations under subsection (1) may provide that the procedure is to consist of either (but not both) of the following—

(a)

a determination by the Authority, on a competitive basis, of the person to whom a licence is to be granted;

(b)

the selection by the Authority, on a non-competitive basis, of the person to whom a licence is to be granted.

(3)

Regulations under subsection (1) may make provision by reference to a determination by the Authority or to the opinion of the Authority as to any matter.

(4)

The approval of the Secretary of State is required for the making of regulations under subsection (1).

(5)

In this section and in sections 91B to 91D

the Authority” means the Gas and Electricity Markets Authority;

smart meter communication licence” means a licence under section 7AB of the Gas Act 1986 or a licence under section 6(1)(f) of the
Electricity Act 1989.

91BRegulations under
section 91A(1): further provision

(1)

Regulations under section 91A(1)

(a)

must make provision so as to ensure that a smart meter communication licence must not be granted to a person unless the Authority is satisfied that the person would not, if granted the licence, have a financial or other interest likely to prejudice the discharge of their functions as the licence holder;

(b)

may make provision about the granting of a licence to a person formed by the Authority.

(2)

Any sums received by the Authority under regulations under section 91A(1) are to be paid into the Consolidated Fund.

(3)

Regulations made in reliance on section 91A(2)(a) may—

(a)

provide for the publication of a proposal to grant a smart meter communication licence;

(b)

provide for the inclusion in such a proposal of an invitation to apply for such a licence;

(c)

impose conditions in relation to the making of an application for a licence;

(d)

impose restrictions in relation to persons who may apply for a licence;

(e)

impose requirements as to the period within which applications must be made;

(f)

make provision for regulating the manner in which applications are to be considered or determined;

(g)

confer on the Authority functions in connection with tender exercises.

(4)

Regulations in reliance on section 91A(2)(a) may also include provision—

(a)

enabling the Authority to require payments to be made, in the form and manner prescribed, in respect of costs incurred or likely to be incurred by the Authority for the purposes of a tender exercise;

(b)

about the effect on a person’s participation in a tender exercise of a failure to comply with a requirement imposed by virtue of paragraph (a);

(c)

about the circumstances in which the tender exercise is to stop as a result of such a failure.

(5)

In this section—

prescribed” means prescribed in or determined under regulations under section 91A(1);

tender exercise” means the procedure set out in regulations made in reliance on section 91A(2)(a) for determining to whom a particular smart meter communication licence is to be granted.

91CPower of Gas and Electricity Markets Authority to amend licence conditions etc

(1)

The Authority may modify—

(a)

a condition of a particular relevant licence;

(b)

the standard conditions incorporated in relevant licences of a particular type;

(c)

a document maintained in accordance with the conditions of a relevant licence, or an agreement that gives effect to a document so maintained.

(2)

The Authority may exercise the power in subsection (1) only if the Authority considers it necessary or expedient to do so for the purposes of, or in preparation for, the grant of a smart meter communication licence.

(3)

The power conferred by subsection (1)

(a)

may be exercised to make different provision for different purposes or different areas;

(b)

may be exercised generally, only in relation to specified cases or subject to exceptions (including provision for a case to be excepted only so long as specified conditions are satisfied);

(c)

includes a power to make incidental, supplementary, consequential or transitional modifications.

(4)

Provision included in a licence in reliance on subsection (1)

(a)

need not relate to the activities authorised by the licence;

(b)

in the case of a licence for the purposes of section 5 of the Gas Act 1986, may do any of the things authorised by section 7B(5) of that Act (which apply to the Authority’s power with respect to licence conditions under section 7B(4)(a));

(c)

in the case of a licence for the purposes of section 4 of the Electricity Act 1989, may do any of the things authorised by section 7(2) to (4) of that Act (which apply to the Authority’s power with respect to licence conditions under section 7(1)(a)).

(5)

A modification under subsection (1) of part of a standard condition of a licence does not prevent any other part of the condition from continuing to be regarded as a standard condition for the purposes of Part 1 of the Gas Act 1986 or Part 1 of the Electricity Act 1989.

(6)

Where the Authority makes modifications under subsection (1) of the standard conditions of a licence of any type, the Authority must—

(a)

make (as nearly as may be) the same modifications of those standard conditions for the purposes of their incorporation in licences of that type granted after that time, and

(b)

publish the modifications.

(7)

In this section—

relevant licence” means a licence for the purposes of section 5 of the Gas Act 1986 or section 4 of the Electricity Act 1989 (prohibitions on unlicensed activities);

specified” means specified in the modification.

91DPower under section 91C: procedure

(1)

Before making a modification under section 91C, the Authority must consult—

(a)

the holder of any licence being modified,

(b)

the Secretary of State, and

(c)

such other persons as the Authority considers appropriate.

(2)

Subsection (1) may be satisfied by consultation undertaken before the passing of the Data (Use and Access) Act 2025.

(3)

If, after carrying out the consultation, the Authority decides to make the modification, it must publish a notice about the decision which—

(a)

states that the Authority has decided to make the modification;

(b)

sets out the modification and its effect;

(c)

specifies the date from which the modification has effect;

(d)

states how the Authority has taken account of any representations made during the consultation;

(e)

states the reason for any differences between the modification consulted on and the proposed modification.

(4)

The notice must be published in such manner as the Authority considers appropriate for bringing it to the attention of those likely to be affected by the making of the modification.”

4

In section 104 (subordinate legislation)—

(a)

in subsection (1), for “or the Scottish Ministers” substitute “, the Scottish Ministers or the Gas and Electricity Markets Authority”;

(b)

in subsection (3), at the end insert “, and

(c)

regulations made by the Gas and Electricity Markets Authority under section 91A.”

Part 2Amendments of other legislation

Gas Act 1986

5

(1)

The Gas Act 1986 is amended as follows.

(2)

In section 7B (licences: general)—

(a)

omit subsection (2B);

(b)

in subsection (2C), after “for” insert “a smart meter communication licence or”.

(3)

In section 41HC (competitive tenders for licences for new licensable activities), in subsection (1), after “activities” insert “, other than a smart meter communication licence,”.

Electricity Act 1989

6

(1)

The Electricity Act 1989 is amended as follows.

(2)

In section 6A (procedure for licence applications)—

(a)

in subsection (1)(a), for “subsections (1A) and (1B)” substitute “subsection (1B)”;

(b)

omit subsection (1A);

(c)

in subsection (1B), after “for” insert “a smart meter communication licence or”.

(3)

In section 56FC (competitive tenders for licences for new licensable activities), in subsection (1), after “activities” insert “, other than a licence under section 6(1)(f) (smart meter communication licence),”.

Electricity and Gas (Competitive Tenders for Smart Meter Communication Licences) Regulations 2012

7

The Electricity and Gas (Competitive Tenders for Smart Meter Communication Licences) Regulations 2012 (S.I. 2012/2414) are revoked.