Legislation – Data (Use and Access) Act 2025

Revised legislation carried on this site may not be fully up to date. At the current time any known changes or effects made by subsequent legislation have been applied to the text of the legislation you are viewing by the editorial team. Please see ‘Frequently Asked Questions’ for details regarding the timescales for which new effects are identified and recorded on this site.

Part 1Access to customer data and business data

Enforcement

8Enforcement of regulations under this Part

(1)

The Secretary of State or the Treasury may by regulations make provision—

(a)

for the purpose of monitoring compliance with regulations under this Part or requirements imposed in exercise of a power conferred by such regulations, and

(b)

for the enforcement of such regulations or requirements,

including provision for monitoring or enforcement by a specified public authority.

(2)

In this Part, “enforcer” means a public authority that is authorised or required to carry out monitoring or enforcement described in subsection (1).

(3)

The following subsections make provision about what regulations under subsection (1) may or must (among other things) contain (and see sections 9 and 10).

(4)

The regulations may confer powers of investigation on an enforcer, including—

(a)

powers to require the provision of documents or information,

(b)

powers to require an individual to attend at a place and answer questions, and

(c)

powers of entry, inspection, search and seizure,

but such powers are subject to the restrictions in section 9 (as well as any restrictions included in the regulations).

(5)

The regulations may—

(a)

make provision enabling an enforcer to issue a notice (“a compliance notice”) requiring compliance with—

(i)

regulations under this Part;

(ii)

a condition for authorisation or approval (referred to in sections 3(2) and 5(3));

(iii)

any other requirement imposed in exercise of a power conferred by regulations under this Part;

(b)

make provision for the enforcement of compliance notices, including provision for their enforcement as if they were orders of a court or tribunal;

(c)

make provision enabling an enforcer to publish a statement to the effect that the enforcer considers that a person is not complying with—

(i)

a requirement imposed by regulations under this Part,

(ii)

a requirement imposed by a compliance notice, or

(iii)

any other requirement imposed in exercise of a power conferred by regulations under this Part.

(6)

The regulations may make provision creating offences punishable with an unlimited fine, or a fine not exceeding a specified amount, in respect of—

(a)

the provision of false or misleading information in response to a request made in accordance with regulations under this Part;

(b)

an act or omission (including falsification) which prevents an enforcer, an interface body or a decision-maker from accessing information, documents, equipment or other material.

(7)

The regulations may make provision enabling a financial penalty to be imposed by an enforcer in respect of—

(a)

the provision of false or misleading information in response to a request made in accordance with regulations under this Part;

(b)

a failure to comply with a requirement imposed by regulations under this Part;

(c)

a failure to comply with a requirement imposed by a compliance notice;

(d)

a failure to comply with any other requirement imposed in exercise of a power conferred by regulations under this Part;

and see section 10 for further provision about financial penalties.

(8)

The regulations may make provision about the rights of persons affected by the exercise of an enforcer’s functions under the regulations, including—

(a)

provision about the review of a decision made in exercise of those functions;

(b)

provision about appeals to a court or tribunal.

(9)

The regulations may make provision about complaints, including provision requiring an enforcer to implement procedures for the handling of complaints.

(10)

The regulations may make provision enabling or requiring an enforcer to publish, or to provide to a specified person, specified documents or information relating to monitoring or enforcement described in subsection (1), including—

(a)

documents or information relating to the exercise of the enforcer’s functions, and

(b)

documents or information relating to convictions for offences.

(11)

The regulations may make provision for an enforcer to arrange for its powers of investigation under the regulations to be exercised by another person.

(12)

The regulations may—

(a)

provide for functions under the regulations to be exercisable by more than one enforcer (whether jointly or concurrently);

(b)

where functions of enforcers are exercisable concurrently—

(i)

provide for one of the enforcers to be the lead enforcer;

(ii)

require the other enforcers to consult the lead enforcer before exercising the functions in a particular case;

(iii)

provide for the lead enforcer to give directions as to which enforcer is to exercise a function in a particular case.

(13)

The regulations may make provision enabling or requiring an enforcer—

(a)

to produce guidance about how it proposes to exercise its functions under the regulations (including provision enabling or requiring enforcers with functions exercisable jointly or concurrently to produce joint guidance),

(b)

to publish the guidance, and

(c)

to provide copies to specified persons.