Data (Use and Access) Act 2025 - Part 2: Digital Verification Services

Border Terrier

GPL, https://commons.wikimedia.org/w/index.php?curid=448544

 

Jane Lambert

On 5 July 1993, The New Yorker published a cartoon by  Peter Steiner of two dogs, one sitting on the floor and the other on a chair with its paw on the keyboard, with the caption "On the Internet, nobody knows you're a dog" (see On the Internet, nobody knows you're a dog Wikipedia).  Part 2 of the Data (Use and Access) Act 2025 may change all that because it aims to regulate digital verification services in the United Kingdom.

In the Department for Digital, Culture, Media and Sport's press release, New legislation set to make digital identities more trustworthy and secure, of 10 March 2022, the previous government explained that digital identities are a new form of ID which can facilitate buying a house or starting a new job.  An extensive consultation took place between July and September 2021, which resulted in legislative proposals on 11 Jan 2023.  As I said in Data Protection Law Reform 23 Dec 2025, the previous government's Data Protection and Digital Information Bill fell with the government but many of its provisions were reintroduced in the Data (Use and Access) Act 2025.   

The provisions for digital verification services appear between s.27 and s.55.  S.27 (2) defines “digital verification services” as verification services provided to any extent by means of the internet.  "Verification services" mean services that are provided at the request of an individual and consist in—

"(a) ascertaining or verifying a fact about the individual from information provided otherwise than by the individual, and
(b) confirming to another person that the fact about the individual has been ascertained or verified from information so provided."

The means by which those services are provided are listed in s.27 (1): 

"(a) a trust framework (see section 28),
(b) supplementary codes (see section 29),
(c) a register (see section 32),
(d) an information gateway (see section 45), and
(e) a trust mark (see section 50)."

The DVS trust  framework is a document prepared and published by the Secretary of State setting out rules concerning the provision of digitak verification services.  The register is an annual register of businesses providing digital verification services.   S.45   provides for information to be given to a registered person.   The Secretary of States is required by s.50 (2) to publish a mark for use in the course of providing, or offering to provide, digital verification services. Only businesses on the register may use that mark and the Secretary of State may seek an injunction or interdict to prevent unauthorized use.

Anyone wishing to discuss this topic may call me on +44 (0)20 7404 5252 during UK office hours or send me a message through my contact page at any time.

Data (Use and Access) Act 2025: Structure

Jane Lambert

 

An inkling of the scope and complexity of the Data (Use and Access) Act 2025 can be gained from the introductory text:

"An Act to make provision about access to customer data and business data; to make provision about services consisting of the use of information to ascertain and verify facts about individuals; to make provision about the recording and sharing, and keeping of registers, of information relating to apparatus in streets; to make provision about the keeping and maintenance of registers of births and deaths; to make provision for the regulation of the processing of information relating to identified or identifiable living individuals; to make provision about privacy and electronic communications; to establish the Information Commission; to make provision about information standards for health and social care; to make provision about the grant of smart meter communication licences; to make provision about the disclosure of information to improve public service delivery; to make provision about the retention of information by providers of internet services in connection with investigations into child deaths; to make provision about providing information for purposes related to the carrying out of independent research into online safety matters; to make provision about the retention of biometric data; to make provision about services for the provision of electronic signatures, electronic seals and other trust services; to make provision about works protected by copyright and the development of artificial intelligence systems; to make provision about the creation of purported intimate images; and for connected purposes.

As I said in Data Protection Law Reform, the Act consists of 144 sections divided into 8 parts with 16 schedules.

Structure

The parts of the Act are as follows:

• Part 1 Access to customer data and business data (sections 1 to 26);
• Part 2 Digital verification services (sections 27 to 55); 
• Part 3 National Underground Asset Register (sections 56 to 60); 
• Part 4 Registers of births and deaths (sections 61 to 65); 
• Part 5 Data protection and privacy (sections 66 to 116):
• Chapter 1 Data protection (sections 66 to 108);
• Chapter 2 Privacy and electronic communications (sections 109 to 116);
• Part 6 The Information Commission (sections 117 to 120); 
• Part 7 Other provision about use of, or access to, data (sections 121 to 138); and 
• Part 8 Final provisions (sections 139 to 144).

The schedules are as follows:

Schedule 1: National Underground Asset Register (England and Wales): monetary penalties; 

Schedule 2: National Underground Asset Register (Northern Ireland): monetary penalties;

Schedule 3: Registers of births and deaths: minor and consequential amendments; 

Schedule 4: Lawfulness of processing: recognised legitimate interests; 

Schedule 5: Purpose limitation: processing to be treated as compatible with original purpose; 

Schedule 6: Automated decision-making: minor and consequential amendments; 

Schedule 7: Transfers of personal data to third countries etc: general processing;

Schedule 8: Transfers of personal data to third countries, etc: law enforcement processing;

Schedule 9: Transfer of personal data to third countries etc: minor and consequential amendments and transitional provision; 

Schedule 10: Complaints: minor and consequential amendments;

Schedule 11: Further minor provision about data protection;
Schedule 12: Storing information in the terminal equipment of a subscriber or user;
Schedule 13: Privacy and electronic communications: Commissioner’s enforcement powers;
Schedule 14: The Information Commission;
Schedule 15: Information standards for health and adult social care in England; and
Schedule 16: Grant of smart meter communication licences.

Further Information

The Departments of State and Ministries concerned with this legislation have prepared explanatory notes on the statute.  Probably the most useful are the Overview (paras 1 to 15) and the Legal Policy (paras 16 to 83).  Also useful are the Guidance on Data Use and Access Act 2025: plans for commencement by the Department for Science, Innovation and Technology ("DSIT"), the Information Commissioner's index page and the DSIT's fact sheets on the UK GDPR and the Data Protection Act, the ICO and the Privacy and Electronic Communications Regulations 2003.

Subsequent articles will discuss particular parts and schedules of the Act.  Anyone wishing to discuss this article may call me on +44 (0)20 7404 5252 during office hours or send me a message through my contact form at any time.

Related Articles

Jane Lambert  Data Protection Law Reform 23 Dec 2025

Jane Lambert Data (Use and Access) Act 2025 - Part 1: Access to Business and Customer Data 11 Jan 2026