Legislation – Data (Use and Access) Act 2025
Part 1
Access to customer data and business data
1 Customer data and business data
2 Power to make provision in connection with customer data
3 Customer data: supplementary
4 Power to make provision in connection with business data
5 Business data: supplementary
8 Enforcement of regulations under this Part
9 Restrictions on powers of investigation etc
14 The FCA and financial services interfaces
15 The FCA and financial services interfaces: supplementary
16 The FCA and financial services interfaces: penalties and levies
17 The FCA and co-ordination with other regulators
20 Restrictions on processing and data protection
21 Regulations under this Part: supplementary
22 Regulations under this Part: Parliamentary procedure and consultation
23 Related subordinate legislation
24 Repeal of provisions relating to supply of customer data
26 Index of defined terms for this Part
Part 2
Digital verification services
30 Withdrawal of a supplementary code
31 Review of DVS trust framework and supplementary codes
33 Registration in the DVS register
34 Power to refuse registration in the DVS register
35 Registration of additional services
37 Addition of services to supplementary notes
38 Applications for registration, supplementary notes, etc
39 Fees for applications for registration, supplementary notes, etc
40 Duty to remove person from the DVS register
41 Power to remove person from the DVS register
42 Duty to remove services from the DVS register
43 Duty to remove supplementary notes from the DVS register
44 Duty to remove services from supplementary notes
45 Power of public authority to disclose information to registered person
46 Information disclosed by the Revenue and Customs
47 Information disclosed by the Welsh Revenue Authority
48 Information disclosed by Revenue Scotland
49 Code of practice about the disclosure of information
50 Trust mark for use by registered persons
51 Power of Secretary of State to require information
52 Arrangements for third party to exercise functions
53 Report on the operation of this Part
54 Index of defined terms for this Part
55 Powers relating to verification of identity or status
Part 3
National Underground Asset Register
56 National Underground Asset Register: England and Wales
57 Information in relation to apparatus: England and Wales
58 National Underground Asset Register: Northern Ireland
59 Information in relation to apparatus: Northern Ireland
60 Pre-commencement consultation
Part 4
Registers of births and deaths
61 Form in which registers of births and deaths are to be kept
62 Provision of equipment and facilities by local authorities
63 Requirements to sign register
64 Treatment of existing registers and records
65 Minor and consequential amendments
Part 5
Data protection and privacy
66 The 2018 Act and the UK GDPR
Definitions in the UK GDPR and the 2018 Act
67 Meaning of research and statistical purposes
68 Consent to processing for the purposes of scientific research
69 Consent to law enforcement processing
72 Processing in reliance on relevant international law
Processing of special categories of personal data
73 Elected representatives responding to requests
74 Processing of special categories of personal data
75 Fees and reasons for responses to data subjects’ requests about law enforcement processing
76 Time limits for responding to data subjects’ requests
77 Information to be provided to data subjects
78 Searches in response to data subjects’ requests
79 Data subjects’ rights to information: legal professional privilege exemption
81 Data protection by design: children’s higher protection matters
Logging of law enforcement processing
82 Logging of law enforcement processing
83 General processing and codes of conduct
84 Law enforcement processing and codes of conduct
International transfers of personal data
85 Transfers of personal data to third countries and international organisations
Safeguards for processing for research etc purposes
86 Safeguards for processing for research etc purposes
87 Section 86: consequential provision
88 National security exemption
89 Joint processing by intelligence services and competent authorities
90 Joint processing: consequential amendments
Information Commissioner’s role
91 Duties of the Commissioner in carrying out functions
92 Codes of practice for the processing of personal data
93 Codes of practice: panels and impact assessments
94 Manifestly unfounded or excessive requests to the Commissioner
96 Notices from the Commissioner
97 Power of the Commissioner to require documents
98 Power of the Commissioner to require a report
99 Assessment notices: removal of OFSTED restriction
102 Annual report on regulatory action
103 Complaints by data subjects
104 Court procedure in connection with subject access requests
105 Consequential amendments to the EITSET Regulations
Protection of prohibitions, restrictions and data subject’s rights
106 Protection of prohibitions, restrictions and data subject’s rights
107 Regulations under the UK GDPR
108 Further minor provision about data protection
Chapter 2 Privacy and electronic communications
110 Interpretation of the PEC Regulations
111 Duty to notify the Commissioner of personal data breach: time periods
112 Storing information in the terminal equipment of a subscriber or user
113 Emergency alerts: interpretation of time periods
114 Use of electronic mail for direct marketing by charities
115 Commissioner’s enforcement powers
Part 6
The Information Commission
117 The Information Commission
118 Abolition of the office of Information Commissioner
119 Transfer of functions to the Information Commission
120 Transfer of property etc to the Information Commission
Part 7
Other provision about use of, or access to, data
121 Information standards for health and adult social care in England
122 Grant of smart meter communication licences
123 Disclosure of information to improve public service delivery to undertakings
124 Retention of information by providers of internet services in connection with death of child
125 Information for research about online safety matters
126 Retention of biometric data and recordable offences
127 Retention of pseudonymised biometric data
128 Retention of biometric data from INTERPOL
130 Recognition of EU conformity assessment bodies
131 Removal of recognition of EU standards etc
132 Recognition of overseas trust products
133 Co-operation between supervisory authority and overseas authorities
134 Time periods: the eIDAS Regulation and the EITSET Regulations
135 Economic impact assessment
136 Report on the use of copyright works in the development of AI systems
138 Creating, or requesting the creation of, purported intimate image of adult
Part 8
Final provisions
139 Power to make consequential amendments
143 Transitional, transitory and saving provision
SCHEDULES
Schedule 1 National Underground Asset Register (England and Wales): monetary penalties
Schedule 2 National Underground Asset Register (Northern Ireland): monetary penalties
Schedule 3 Registers of births and deaths: minor and consequential amendments
Schedule 4 Lawfulness of processing: recognised legitimate interests
Schedule 5 Purpose limitation: processing to be treated as compatible with original purpose
Schedule 6 Automated decision-making: minor and consequential amendments
Schedule 7 Transfers of personal data to third countries etc: general processing
Schedule 8 Transfers of personal data to third countries etc: law enforcement processing
Schedule 10 Complaints: minor and consequential amendments
Schedule 11 Further minor provision about data protection
Schedule 12 Storing information in the terminal equipment of a subscriber or user
Schedule 13 Privacy and electronic communications: Commissioner’s enforcement powers
Schedule 14 The Information Commission
Schedule 15 Information standards for health and adult social care in England
Changes to legislation:
There are currently no known outstanding effects for the Data (Use and Access) Act 2025, Section 66.
Changes to Legislation
Revised legislation carried on this site may not be fully up to date. At the current time any known changes or effects made by subsequent legislation have been applied to the text of the legislation you are viewing by the editorial team. Please see ‘Frequently Asked Questions’ for details regarding the timescales for which new effects are identified and recorded on this site.
Part 5Data protection and privacy
Chapter 1Data protection
Terms used in this Chapter
66The 2018 Act and the UK GDPR
In this Chapter—
“the 2018 Act” means the Data Protection Act 2018;
“the UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.