Data (Use and Access) Act 2025: Structure

Jane Lambert

 

An inkling of the scope and complexity of the Data (Use and Access) Act 2025 can be gained from the introductory text:

"An Act to make provision about access to customer data and business data; to make provision about services consisting of the use of information to ascertain and verify facts about individuals; to make provision about the recording and sharing, and keeping of registers, of information relating to apparatus in streets; to make provision about the keeping and maintenance of registers of births and deaths; to make provision for the regulation of the processing of information relating to identified or identifiable living individuals; to make provision about privacy and electronic communications; to establish the Information Commission; to make provision about information standards for health and social care; to make provision about the grant of smart meter communication licences; to make provision about the disclosure of information to improve public service delivery; to make provision about the retention of information by providers of internet services in connection with investigations into child deaths; to make provision about providing information for purposes related to the carrying out of independent research into online safety matters; to make provision about the retention of biometric data; to make provision about services for the provision of electronic signatures, electronic seals and other trust services; to make provision about works protected by copyright and the development of artificial intelligence systems; to make provision about the creation of purported intimate images; and for connected purposes.

As I said in Data Protection Law Reform, the Act consists of 144 sections divided into 8 parts with 16 schedules.

Structure

The parts of the Act are as follows:

• Part 1 Access to customer data and business data (sections 1 to 26);
• Part 2 Digital verification services (sections 27 to 55); 
• Part 3 National Underground Asset Register (sections 56 to 60); 
• Part 4 Registers of births and deaths (sections 61 to 65); 
• Part 5 Data protection and privacy (sections 66 to 116):
• Chapter 1 Data protection (sections 66 to 108);
• Chapter 2 Privacy and electronic communications (sections 109 to 116);
• Part 6 The Information Commission (sections 117 to 120); 
• Part 7 Other provision about use of, or access to, data (sections 121 to 138); and 
• Part 8 Final provisions (sections 139 to 144).

The schedules are as follows:

Schedule 1: National Underground Asset Register (England and Wales): monetary penalties; 

Schedule 2: National Underground Asset Register (Northern Ireland): monetary penalties;

Schedule 3: Registers of births and deaths: minor and consequential amendments; 

Schedule 4: Lawfulness of processing: recognised legitimate interests; 

Schedule 5: Purpose limitation: processing to be treated as compatible with original purpose; 

Schedule 6: Automated decision-making: minor and consequential amendments; 

Schedule 7: Transfers of personal data to third countries etc: general processing;

Schedule 8: Transfers of personal data to third countries, etc: law enforcement processing;

Schedule 9: Transfer of personal data to third countries etc: minor and consequential amendments and transitional provision; 

Schedule 10: Complaints: minor and consequential amendments;

Schedule 11: Further minor provision about data protection;
Schedule 12: Storing information in the terminal equipment of a subscriber or user;
Schedule 13: Privacy and electronic communications: Commissioner’s enforcement powers;
Schedule 14: The Information Commission;
Schedule 15: Information standards for health and adult social care in England; and
Schedule 16: Grant of smart meter communication licences.

Further Information

The Departments of State and Ministries concerned with this legislation have prepared explanatory notes on the statute.  Probably the most useful are the Overview (paras 1 to 15) and the Legal Policy (paras 16 to 83).  Also useful are the Guidance on Data Use and Access Act 2025: plans for commencement by the Department for Science, Innovation and Technology ("DSIT"), the Information Commissioner's index page and the DSIT's fact sheets on the UK GDPR and the Data Protection Act, the ICO and the Privacy and Electronic Communications Regulations 2003.

Subsequent articles will discuss particular parts and schedules of the Act.  Anyone wishing to discuss this article may call me on +44 (0)20 7404 5252 during office hours or send me a message through my contact form at any time.

Related Articles

Jane Lambert  Data Protection Law Reform 23 Dec 2025

Jane Lambert Data (Use and Access) Act 2025 - Part 1: Access to Business and Customer Data 11 Jan 2026

Privacy Sandbox

Author Hyena
Reproduced with kind permission of the author
Source Wikipedia

Jane Lambert

The Information Commissioner's Office has just carried out a consultation on creating a regulatory sandbox "to develop innovative products and services using personal data in innovative ways" (see ICO call for views on creating a regulatory sandbox on the ICO website).  The idea of a sandbox was pioneered by the Financial Conduct Authority which described it as  "a ‘safe space’ in which businesses can test innovative products, services, business models and delivery mechanisms without immediately incurring all the normal regulatory consequences of engaging in the activity in question" (see FCA Regulatory Sandbox Nov 2015). 

The FCA's idea of a sandbox for new products, services and business models proved not only feasible but popular and has been imitated by other financial services regulators around the world.  The Information Commissioner announced her intention of extending the idea to data protection in her Information Rights Strategic Plan 2017 - 2021:

"Technology goal #8: To engage with organisations in a safe and controlled environment to understand and explore innovative technology. 

• We will establish a ‘regulatory sandbox’, drawing on the successful sandbox process that the Financial Conduct Authority has developed. The ICO sandbox will enable organisations to develop innovative digital products and services, whilst engaging with the regulator, ensuring that appropriate protections and safeguards are in place. As part of the sandbox process the ICO would provide advice on mitigating risks and data protection by design. 

• In 2018 we will consult and engage with organisations about implementation of a sandbox."

The consultation closed on Friday but the Call for Evidence makes clear that that was only the first stage of the consultation process. There will be a more detailed proposal for consultation later in the year.

In his blog post Your views will help us build our regulatory sandbox, Chris Taylor, Head of Assurance at the ICO, set out the topics upon which he wants to hear from the public:

• "what you think the scope of any such sandbox should be - should we focus on particular innovations, sectors or types of organisations?
• what you think the benefits might be to working in a sandbox, whether that’s our expert input or increased reassurance for your customers or clients.
• what mechanisms you might find most helpful in a sandbox – from adaptations to our approach, to informal steers or the provision of technical guidance – what are the tools that a sandbox might contain?
• at what stage in the design and development process a sandbox would be most useful to you?"

Mr Taylor also made a point that applies to innovation generally and not just to data protection law.  It is often said in the USA and in some quarters in this country that red tape (which is a derogatory term for regulation) hobbles innovation and enterprise.   If that were so the USA would be the most innovative nation on earth but a glance of the Global Innovation Index  shows that it lies behind four European nations including the UK. 

The author explains that 

"privacy and innovation go hand in hand. It’s not privacy or innovation, it’s privacy and innovation – because organisations that use our sandbox won’t be exempt from data protection law."

A regulatory sandbox enables regulators to anticipate and make provision for difficulties before they arise thus rescuing sparing new technologies and businesses from the legal quagmires that dogged earlier technologies.  In those days the law reacted to new technologies often imperfectly. 

The proposed sandbox should mitigate the privacy uncertainties affecting new products, services and business models but they won't remove all. There will remain other issues such as patenting or other IP protection, licensing, competition and so firth.  I am well placed and should be glad to help fintech and other entrepreneurs or the patent and trade mark attorneys, solicitors, accountants and other professional advisers who may assist them.  Should any of them wish to discuss this article or data protection generally, they are welcome to call me on +44 (0)20 7404 5252 during office houses or send me a message through my contact form.