Legislation – Data (Use and Access) Act 2025

New Search

Introduction

Part 1
Access to customer data and business data

1 Customer data and business data

2 Power to make provision in connection with customer data

3 Customer data: supplementary

4 Power to make provision in connection with business data

5 Business data: supplementary

6 Decision-makers

7 Interface bodies

8 Enforcement of regulations under this Part

9 Restrictions on powers of investigation etc

10 Financial penalties

11 Fees

12 Levy

13 Financial assistance

14 The FCA and financial services interfaces

15 The FCA and financial services interfaces: supplementary

16 The FCA and financial services interfaces: penalties and levies

17 The FCA and co-ordination with other regulators

18 Liability in damages

19 Duty to review regulations

20 Restrictions on processing and data protection

21 Regulations under this Part: supplementary

22 Regulations under this Part: Parliamentary procedure and consultation

23 Related subordinate legislation

24 Repeal of provisions relating to supply of customer data

25 Other defined terms

26 Index of defined terms for this Part

Part 2
Digital verification services

27 Introductory

28 DVS trust framework

29 Supplementary codes

30 Withdrawal of a supplementary code

31 Review of DVS trust framework and supplementary codes

32 DVS register

33 Registration in the DVS register

34 Power to refuse registration in the DVS register

35 Registration of additional services

36 Supplementary notes

37 Addition of services to supplementary notes

38 Applications for registration, supplementary notes, etc

39 Fees for applications for registration, supplementary notes, etc

40 Duty to remove person from the DVS register

41 Power to remove person from the DVS register

42 Duty to remove services from the DVS register

43 Duty to remove supplementary notes from the DVS register

44 Duty to remove services from supplementary notes

45 Power of public authority to disclose information to registered person

46 Information disclosed by the Revenue and Customs

47 Information disclosed by the Welsh Revenue Authority

48 Information disclosed by Revenue Scotland

49 Code of practice about the disclosure of information

50 Trust mark for use by registered persons

51 Power of Secretary of State to require information

52 Arrangements for third party to exercise functions

53 Report on the operation of this Part

54 Index of defined terms for this Part

55 Powers relating to verification of identity or status

Part 3
National Underground Asset Register

56 National Underground Asset Register: England and Wales

57 Information in relation to apparatus: England and Wales

58 National Underground Asset Register: Northern Ireland

59 Information in relation to apparatus: Northern Ireland

60 Pre-commencement consultation

Part 4
Registers of births and deaths

61 Form in which registers of births and deaths are to be kept

62 Provision of equipment and facilities by local authorities

63 Requirements to sign register

64 Treatment of existing registers and records

65 Minor and consequential amendments

Part 5
Data protection and privacy

Chapter 1 Data protection

Terms used in this Chapter

66 The 2018 Act and the UK GDPR

Definitions in the UK GDPR and the 2018 Act

67 Meaning of research and statistical purposes

68 Consent to processing for the purposes of scientific research

69 Consent to law enforcement processing

Data protection principles

70 Lawfulness of processing

71 The purpose limitation

72 Processing in reliance on relevant international law

Processing of special categories of personal data

73 Elected representatives responding to requests

74 Processing of special categories of personal data

Data subject’s rights

75 Fees and reasons for responses to data subjects’ requests about law enforcement processing

76 Time limits for responding to data subjects’ requests

77 Information to be provided to data subjects

78 Searches in response to data subjects’ requests

79 Data subjects’ rights to information: legal professional privilege exemption

Automated decision-making

80 Automated decision-making

Obligations of controllers

81 Data protection by design: children’s higher protection matters

Logging of law enforcement processing

82 Logging of law enforcement processing

Codes of conduct

83 General processing and codes of conduct

84 Law enforcement processing and codes of conduct

International transfers of personal data

85 Transfers of personal data to third countries and international organisations

Safeguards for processing for research etc purposes

86 Safeguards for processing for research etc purposes

87 Section 86: consequential provision

National security

88 National security exemption

Intelligence services

89 Joint processing by intelligence services and competent authorities

90 Joint processing: consequential amendments

Information Commissioner’s role

91 Duties of the Commissioner in carrying out functions

92 Codes of practice for the processing of personal data

93 Codes of practice: panels and impact assessments

94 Manifestly unfounded or excessive requests to the Commissioner

95 Analysis of performance

96 Notices from the Commissioner

Enforcement

97 Power of the Commissioner to require documents

98 Power of the Commissioner to require a report

99 Assessment notices: removal of OFSTED restriction

100 Interview notices

101 Penalty notices

102 Annual report on regulatory action

103 Complaints by data subjects

104 Court procedure in connection with subject access requests

105 Consequential amendments to the EITSET Regulations

Protection of prohibitions, restrictions and data subject’s rights

106 Protection of prohibitions, restrictions and data subject’s rights

Miscellaneous

107 Regulations under the UK GDPR

108 Further minor provision about data protection

Chapter 2 Privacy and electronic communications

109 The PEC Regulations

110 Interpretation of the PEC Regulations

111 Duty to notify the Commissioner of personal data breach: time periods

112 Storing information in the terminal equipment of a subscriber or user

113 Emergency alerts: interpretation of time periods

114 Use of electronic mail for direct marketing by charities

115 Commissioner’s enforcement powers

116 Codes of conduct

Part 6
The Information Commission

117 The Information Commission

118 Abolition of the office of Information Commissioner

119 Transfer of functions to the Information Commission

120 Transfer of property etc to the Information Commission

Part 7
Other provision about use of, or access to, data

121 Information standards for health and adult social care in England

122 Grant of smart meter communication licences

123 Disclosure of information to improve public service delivery to undertakings

124 Retention of information by providers of internet services in connection with death of child

125 Information for research about online safety matters

126 Retention of biometric data and recordable offences

127 Retention of pseudonymised biometric data

128 Retention of biometric data from INTERPOL

129 The eIDAS Regulation

130 Recognition of EU conformity assessment bodies

131 Removal of recognition of EU standards etc

132 Recognition of overseas trust products

133 Co-operation between supervisory authority and overseas authorities

134 Time periods: the eIDAS Regulation and the EITSET Regulations

135 Economic impact assessment

136 Report on the use of copyright works in the development of AI systems

137 Progress statement

138 Creating, or requesting the creation of, purported intimate image of adult

Part 8
Final provisions

139 Power to make consequential amendments

140 Regulations

141 Extent

142 Commencement

143 Transitional, transitory and saving provision

144 Short title

SCHEDULES

Schedule 1 National Underground Asset Register (England and Wales): monetary penalties

Schedule 2 National Underground Asset Register (Northern Ireland): monetary penalties

Schedule 3 Registers of births and deaths: minor and consequential amendments

Schedule 4 Lawfulness of processing: recognised legitimate interests

Schedule 5 Purpose limitation: processing to be treated as compatible with original purpose

Schedule 6 Automated decision-making: minor and consequential amendments

Schedule 7 Transfers of personal data to third countries etc: general processing

Schedule 8 Transfers of personal data to third countries etc: law enforcement processing

Schedule 9 Transfers of personal data to third countries etc: minor and consequential amendments and transitional provision

Schedule 10 Complaints: minor and consequential amendments

Schedule 11 Further minor provision about data protection

Schedule 12 Storing information in the terminal equipment of a subscriber or user

Schedule 13 Privacy and electronic communications: Commissioner’s enforcement powers

Schedule 14 The Information Commission

Schedule 15 Information standards for health and adult social care in England

Schedule 16 Grant of smart meter communication licences

Changes to legislation:

There are currently no known outstanding effects for the Data (Use and Access) Act 2025, Section 138. Help about Changes to Legislation

Close

Changes to Legislation

Revised legislation carried on this site may not be fully up to date. At the current time any known changes or effects made by subsequent legislation have been applied to the text of the legislation you are viewing by the editorial team. Please see ‘Frequently Asked Questions’ for details regarding the timescales for which new effects are identified and recorded on this site.

Part 7Other provision about use of, or access to, data

Purported intimate images

138Creating, or requesting the creation of, purported intimate image of adult

(1)

The Sexual Offences Act 2003 is amended in accordance with subsections (2) and (3).

(2)

After section 66D insert—

“66ECreating purported intimate image of adult

(1)

A person (A) commits an offence if—

(a)

A intentionally creates a purported intimate image of another person (B),

(b)

B does not consent to the creation of the purported intimate image, and

(c)

A does not reasonably believe that B consents.

(2)

“Purported intimate image” of a person means an image which—

(a)

appears to be, or to include, a photograph or film of the person (but is not, or is not only, a photograph or film of the person),

(b)

appears to be of an adult, and

(c)

appears to show the person in an intimate state.

(3)

Subsections (5) to (9) of section 66D (person in an intimate state) apply for the purposes of this section as if references in those subsections to a photograph or film were references to an image.

(4)

References in this section to creating a purported intimate image of a person do not include doing so by modifying a photograph or film of the person where what is created by the modification is an image which—

(a)

appears to show the person, but

(b)

does not appear to show—

(i)

something within section 66D(5)(a) to (e) (read with subsections (6) and (7) of that section) which is not shown in the photograph or film, or

(ii)

a person who is not shown in the photograph or film.

(5)

It is a defence for a person charged with an offence under this section to prove that the person had a reasonable excuse for creating the purported intimate image.

(6)

A person who commits an offence under this section is liable on summary conviction to imprisonment for a term not exceeding the maximum term for summary offences or a fine (or both).

(7)

The Secretary of State must—

(a)

review the operation of subsection (5),

(b)

publish the outcome of the review in a report before the end of the period of two years beginning with the day on which this section comes into force, and

(c)

lay the report before Parliament.

66FRequesting the creation of purported intimate image of adult

(1)

A person (A) commits an offence if—

(a)

A intentionally requests the creation of a purported intimate image of another person (B) (either in general or specific terms),

(b)

B does not consent to A requesting the creation of the purported intimate image, and

(c)

A does not reasonably believe that B consents.

(2)

A person (A) commits an offence if—

(a)

A intentionally requests that, if a purported intimate image of another person (B) is created, it includes or excludes something in particular (whether relating to B’s appearance, the intimate state in which B is shown or anything else),

(b)

B does not consent to A requesting the inclusion or exclusion of that thing, and

(c)

A does not reasonably believe that B consents.

(3)

References in this section to making a request (however expressed) include doing an act which could reasonably be taken to be a request (such as, for example, indicating agreement in response to an offer or complying with conditions of an offer).

(4)

References in this section to making a request (however expressed) are references to—

(a)

making a request directed to a particular person or persons, or

(b)

making a request so that it is available to one or more persons (or people generally), without directing it to a particular person or persons.

(5)

References in this section to consent to a person requesting something are—

(a)

in a case described in subsection (4)(a), references to consent to a request being made that is directed to the particular person or persons, and

(b)

in a case described in subsection (4)(b), references to consent to a request being made so that it is available to the person or persons (or people generally), as appropriate.

(6)

An offence under this section is committed—

(a)

regardless of whether the purported intimate image is created,

(b)

regardless of whether the purported intimate image, or the particular thing to be included in or excluded from such an image, is also requested by another person, and

(c)

regardless of where in the world the person or persons mentioned in subsection (4)(a)and (b) is or are located.

(7)

It is a defence for a person charged with an offence under this section to prove that the person had a reasonable excuse for making the request.

(8)

A person who commits an offence under this section is liable on summary conviction to imprisonment for a term not exceeding the maximum term for summary offences or a fine (or both).

(9)

In this section, references to a purported intimate image, to creating such an image and to a person shown in an intimate state have the same meaning as in section 66E.

(10)

The Secretary of State must—

(a)

review the operation of subsection (7),

(b)

publish the outcome of the review in a report before the end of the period of two years beginning with the day on which this section comes into force, and

(c)

lay the report before Parliament.

66GCreating, or requesting the creation of, purported intimate image of adult: further definitions etc

(1)

This section applies for the purposes of sections 66E and 66F.

(2)

“Consent” to an act includes general consent covering the particular act as well as specific consent to that particular act (and see also section 66F(5)).

(3)

Whether a belief is “reasonable” is to be determined having regard to all the circumstances, including any steps A has taken to ascertain whether B consents.

(4)

Photograph” includes the negative as well as the positive version.

(5)

Film” means a moving image.

(6)

A reference to an “image”, “photograph” or “film” includes data stored by any means which is capable of conversion into an image, photograph or film.

(7)

An image of a person appears to be an image of an adult if—

(a)

the impression conveyed by the image is that the person shown is aged 18 or over, or

(b)

the predominant impression conveyed by the image is that the person shown is aged 18 or over (even if some of the physical characteristics shown are those of a person under 18).

(8)

The “maximum term for summary offences” means—

(a)

if the offence is committed before the time when section 281(5) of the Criminal Justice Act 2003 comes into force, six months;

(b)

if the offence is committed after that time, 51 weeks.

66HCreating, or requesting the creation of, purported intimate image of adult: time limit for prosecution

(1)

Notwithstanding section 127(1) of the Magistrates’ Courts Act 1980, a magistrates’ court may try an information or written charge relating to an offence under section 66E or 66F if the information is laid or the charge is issued—

(a)

before the end of the period of 3 years beginning with the day on which the offence was committed, and

(b)

before the end of the period of 6 months beginning with the day on which evidence which the prosecutor thinks is sufficient to justify a prosecution comes to the prosecutor’s knowledge.

(2)

A certificate signed by or on behalf of a prosecutor stating the date on which evidence described in subsection (1)(b) came to the prosecutor’s knowledge is conclusive evidence of that fact.”

(3)

In section 79(5) (meaning of references to image of a person), after “a person” insert “(except in sections 66E, 66F and 66G)”.

(4)

In the Armed Forces Act 2006, after section 177D insert—

“177DAPurported intimate images to be treated as used for purpose of certain offences

(1)

This section applies where a person commits an offence under section 42 as respects which the corresponding offence under the law of England and Wales is an offence under section 66E of the Sexual Offences Act 2003 (creating purported intimate image of adult).

(2)

The purported intimate image to which the offence relates, and anything containing it, is to be regarded for the purposes of section 177C(3) (and section 94A(3)(b)(ii)) as used for the purposes of committing the offence (including where it is committed by aiding, abetting, counselling or procuring).”

(5)

In Part 2 of Schedule 3 to the Serious Crime Act 2007 (offences to be disregarded in reckoning whether an act is capable of encouraging or assisting the commission of an offence: England and Wales), after paragraph 38 insert—

“Sexual Offences Act 2003

38ZA

An offence under section 66F of the Sexual Offences Act 2003 (requesting the creation of purported intimate image of adult).”

(6)

In the Sentencing Code, after section 154 insert—

“154APurported intimate images to be treated as used for purpose of certain offences

(1)

Subsection (2) applies where a person commits an offence under section 66E of the Sexual Offences Act 2003 (creating purported intimate image of adult).

(2)

The purported intimate image to which the offence relates, and anything containing it, is to be regarded for the purposes of section 153 (and section 157(3)(b)) as used for the purposes of committing the offence (including where it is committed by aiding, abetting, counselling or procuring).

(3)

Subsection (4) applies where a person commits an offence under section 66F of the Sexual Offences Act 2003 (requesting the creation of purported intimate image of adult).

(4)

A purported intimate image which is connected with the offence, and anything containing it, is to be regarded for the purposes of section 153 (and section 157(3)(b)) as used for the purposes of committing the offence (including where it is committed by aiding, abetting, counselling or procuring).

(5)

A purported intimate image is connected with an offence under section 66F of the Sexual Offences Act 2003 if —

(a)

it appears to be of a person who was the subject of the request to which the offence relates (whether or not it is what was requested), and

(b)

it was in the offender’s possession, or under the offender’s control, as a result of that request.”

Annotations:
Commencement Information

I1S. 138 not in force at Royal Assent, see s. 142(1)