Legalize / United Kingdom / Public General Act

Data (Use and Access) Act 2025

Type Public General Act

Publication 2025-06-19

Last updated 2026-03-31

State In force

Department Statute Law Database

Source legislation.gov.uk

articles Not indexed

Reform history JSON API

(5) The Secretary of State may revise and republish the DVS trust framework (whether following a review under section 31 or otherwise).

(6) The DVS trust framework, and any revised version of the framework, must specify the time it comes into force (which must not be a time earlier than the time it is published).

(7) The DVS trust framework, and any revised version of the framework, may—

(a) set out different rules for different digital verification services,

(b) specify that provisions come into force at different times for different purposes, and

(8) Where the Secretary of State revises and republishes the DVS trust framework, the DVS trust framework (as revised) may provide that from a date, or from the end of a period, specified in the framework a pre-revision certificate is required to be ignored for the purposes of sections 33(1)(a), 35(1)(c), 40(1)(c) and 42(1)(c).

(9) In subsection (8), a “pre-revision certificate” means a certificate which—

(a) certifies that digital verification services provided by the holder of the certificate are provided in accordance with the DVS trust framework, and

(b) was issued before the time the relevant revision to the DVS trust framework comes into force.

(10) Provision included in the DVS trust framework in reliance on subsection (8) may make different provision in relation to different descriptions of pre-revision certificate.

Supplementary codes

29

(1) The Secretary of State may prepare and publish one or more sets of rules concerning the provision of digital verification services which supplement the DVS trust framework.

(2) In this Part, a set of rules published under subsection (1) is referred to as a supplementary code.

(3) Those rules may include (among other things) rules relating to, and to the conduct of, a person who provides such services; and in this Part references to a person providing services in accordance with a supplementary code (however expressed) include a person complying with such rules.

(4) In preparing a set of rules, the Secretary of State must consult—

(a) the Information Commissioner, and

(b) such other persons as the Secretary of State considers appropriate.

(5) The requirement in subsection (4) may be satisfied by consultation undertaken before the coming into force of this section.

(6) The Secretary of State may revise and republish a supplementary code (whether following a review under section 31 or otherwise).

(7) A supplementary code, and any revised version of a supplementary code, must specify the time it comes into force (which must not be a time earlier than the time it is published).

(8) A supplementary code, and any revised version of a supplementary code, may—

(a) set out different rules for different digital verification services,

(b) specify that provisions come into force at different times for different purposes, and

(9) Where the Secretary of State revises and republishes a supplementary code, the supplementary code (as revised) may provide that from a date, or from the end of a period, specified in the code a pre-revision certificate is required to be ignored for the purposes of sections 36(1)(a), 37(1)(c), 43(1)(c)and 44(1)(c).

(10) In subsection (9), a “pre-revision certificate” means a certificate which—

(a) certifies that digital verification services provided by the holder of the certificate are provided in accordance with the supplementary code, and

(b) was issued before the time the relevant revision to the supplementary code comes into force.

(11) Provision included in a supplementary code in reliance on subsection (9) may make different provision in relation to different descriptions of pre-revision certificate.

Withdrawal of a supplementary code

30

(1) The Secretary of State may determine to withdraw a supplementary code.

(2) A determination must—

(a) be published, and

(b) specify when the code is withdrawn, which must be a time after the end of the period of 21 days beginning with the day on which the determination is published.

Review of DVS trust framework and supplementary codes

31

(1) At least every 12 months, the Secretary of State must—

(a) carry out a review of the DVS trust framework, and

(b) at the same time, carry out a review of each supplementary code which has not been withdrawn.

(2) In carrying out a review under subsection (1), the Secretary of State must consult—

(a) the Information Commissioner, and

(b) such other persons as the Secretary of State considers appropriate.

DVS register

32

(1) The Secretary of State must establish and maintain a register of persons providing digital verification services.

(2) The register is referred to in this Part as the DVS register.

(3) The Secretary of State must make the DVS register publicly available.

Registration in the DVS register

33

(1) The Secretary of State must register a person providing digital verification services in the DVS register if—

(a) the person holds a certificate from an accredited conformity assessment body certifying that digital verification services provided by the person are provided in accordance with the DVS trust framework,

(b) the person applies to be registered in the DVS register in respect of one or more of the digital verification services to which the certificate relates,

(d) the person complies with any regulations under section 39(1) requiring a fee to be paid.

(2) But subsection (1) is subject to—

(a) the power to refuse registration under section 34(1), and

(b) the duties to refuse registration under sections 34(10) and 41(10).

(3) If the conditions in paragraphs (a) to (d) of subsection (1) are not met, the Secretary of State may not register a person in the DVS register.

(4) The register must record the digital verification services in respect of which a person is, from time to time, registered.

(5) For the purposes of subsection (1)(a), a certificate is to be ignored if—

(a) it has expired in accordance with its terms,

(b) it has been withdrawn by the body that issued it, or

(6) In this Part, “accredited conformity assessment body” means a conformity assessment body that is accredited by the UK national accreditation body in accordance with Article 5 of the Accreditation Regulation as competent to carry out assessments of whether digital verification services are provided in accordance with the DVS trust framework.

(7) In subsection (6)—

“the Accreditation Regulation” means Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93;

“conformity assessment body” has the same meaning as in the Accreditation Regulation (see Article 2(13) of that Regulation);

“the UK national accreditation body” means the UK national accreditation body for the purposes of Article 4(1) of the Accreditation Regulation.

Power to refuse registration in the DVS register

34

(1) The Secretary of State may refuse to register a person providing digital verification services in the DVS register if the Secretary of State—

(a) considers that it is necessary to do so in the interests of national security, or

(b) is satisfied that the person is failing to comply with the DVS trust framework in respect of one or more of the digital verification services in respect of which the person applies to be registered.

(2) Before refusing to register a person under this section the Secretary of State must, by written notice, inform the person that the Secretary of State intends to do so.

(3) The notice must—

(a) state the name and address of the person,

(b) state the reason why the Secretary of State—

(i) considers that it is necessary to refuse to register the person in the interests of national security, or

(ii) is satisfied that the person is failing as mentioned in subsection (1)(b),

(c) state whether the Secretary of State intends to specify a period in the notice under subsection (8) and, if so, what period is intended to be specified,

(d) state that the person may make written representations to the Secretary of State about—

(i) the Secretary of State’s intention to refuse to register the person in the DVS register, and

(ii) where relevant, the period the Secretary of State intends to specify in the notice under subsection (8), and

(e) specify the period within which such representations may be made.

(4) Where the Secretary of State intends to refuse to register a person in reliance on subsection (1)(a), the requirement in subsection (3)(b) does not apply if, or to the extent that, the Secretary of State considers that stating the reason described in subsection (3)(b)(i) would be contrary to the interests of national security.

(5) The period specified for making written representations must be a period of not less than 21 days beginning with the day on which the notice is given.

(6) If the Secretary of State considers that it is appropriate for the person to have an opportunity to make oral representations about the matters mentioned in subsection (3)(d), the notice must also—

(a) state that the person may make such representations, and

(b) specify the arrangements for making such representations and the time at which, or the period within which, they may be made.

(7) When deciding whether to refuse to register the person in the DVS register under this section, the Secretary of State must consider any oral or written representations made by the person in accordance with the notice.

(8) Where the Secretary of State refuses to register the person in the DVS register under this section, the Secretary of State must by written notice inform the person that the person’s application for registration has been refused.

(9) The Secretary of State may, in the notice given under subsection (8), state that any further application for registration made by the person during a period specified in the notice will be refused.

(10) If the person applies to be registered in the DVS register during the period specified in the notice in reliance on subsection (9), the Secretary of State must refuse the application.

(11) The period specified in the notice in reliance on subsection (9) must begin with the day on which the notice is given and must not exceed two years.

Registration of additional services

35

(1) Subsection (2) applies if—

(a) a person is registered in the DVS register,

(b) the person applies for their entry in the register to be amended to record additional digital verification services that the person provides in accordance with the DVS trust framework,

(c) the person holds a certificate from an accredited conformity assessment body certifying that the person provides the additional services in accordance with the DVS trust framework,

(d) the application complies with any requirements imposed by a determination under section 38, and

(e) the person complies with any regulations under section 39(1) requiring a fee to be paid.

(2) The Secretary of State must amend the DVS register to record that the person is also registered in respect of the additional services referred to in subsection (1).

(3) If the conditions in paragraphs (a) to (e) of subsection (1) are not met, the Secretary of State may not amend the DVS register as described in subsection (2).

(4) For the purposes of subsection (1)(c), a certificate is to be ignored if—

(a) it has expired in accordance with its terms,

(b) it has been withdrawn by the body that issued it, or

Supplementary notes

36

(1) Subsection (2) applies if—

(a) a person holds a certificate from an accredited conformity assessment body certifying that digital verification services provided by the person are provided in accordance with a supplementary code,

(b) the person applies for a note about one or more of the services to which the certificate relates to be included in the entry relating to that person in the DVS register,

(d) the person complies with any regulations under section 39(1) requiring a fee to be paid.

(2) The Secretary of State must include a note in the entry relating to the person in the DVS register recording that the person provides, in accordance with the supplementary code referred to in subsection (1), the services in respect of which the person made the application referred to in that subsection.

(3) But subsection (2) does not apply if the supplementary code referred to in subsection (1) has been withdrawn.

(4) If the conditions in paragraphs (a) to (d) of subsection (1) are not met, the Secretary of State may not include a note described in subsection (2) in the DVS register.

(5) For the purposes of subsection (1)(a), a certificate is to be ignored if—

(a) it has expired in accordance with its terms,

(b) it has been withdrawn by the body that issued it, or

(6) In this Part, a note included in the DVS register in accordance with subsection (2) is referred to as a supplementary note.

Addition of services to supplementary notes

37

(1) Subsection (2) applies if—

(a) a person has a supplementary note included in the DVS register relating to a supplementary code,

(b) the person applies for the note to be amended to record additional digital verification services that the person provides in accordance with that code,

(c) the person holds a certificate from an accredited conformity assessment body certifying that the person provides the additional services in accordance with that code,

(d) the application complies with any requirements imposed by a determination under section 38, and

(e) the person complies with any regulations under section 39(1) requiring a fee to be paid.

(2) The Secretary of State must amend the note to record that the person also provides the additional services referred to in subsection (1) in accordance with the supplementary code to which the note relates.

(3) But subsection (2) does not apply if the supplementary code to which the note relates has been withdrawn.

(4) If the conditions in paragraphs (a) to (e) of subsection (1) are not met, the Secretary of State may not amend the note as described in subsection (2).

(5) For the purposes of subsection (1)(c), a certificate is to be ignored if—

(a) it has expired in accordance with its terms,

(b) it has been withdrawn by the body that issued it, or

Applications for registration, supplementary notes, etc

38

(1) The Secretary of State may determine—

(a) the form of an application under section 33, 35, 36 or 37,

(b) the information to be contained in or provided with the application,

(d) the manner in which the application is to be submitted.

(2) A determination may make different provision for different purposes.

(3) The Secretary of State must publish a determination.

(4) The Secretary of State may revise a determination.

(5) If the Secretary of State revises a determination the Secretary of State must publish the determination as revised.

Fees for applications for registration, supplementary notes, etc

39

(1) The Secretary of State may by regulations make provision for or in connection with—

(a) the payment of fees for applications under sections 33, 35, 36 and 37, and

(b) the payment of fees in connection with continued registration in the DVS register.

(2) The regulations may not provide for payment of fees to anyone other than the Secretary of State.

(3) The regulations must—

(a) specify the amount, or the maximum amount of a fee, or

(b) provide for a fee, or the maximum amount of a fee, to be determined in accordance with regulations.

(4) The regulations may provide for the amount of a fee to exceed the administrative costs of determining the application or the administrative costs associated with the continued registration (as the case may be).

(5) Regulations under subsection (1) may (among other things) make provision about the following—

(a) when fees are to be paid;

(b) the manner in which fees are to be paid;

(d) exceptions to requirements to pay fees;

(e) the refund of fees (in whole or in part);

(f) interest on any unpaid amounts,

including provision conferring functions on the Secretary of State in relation to the matters in paragraphs (a) to (e).

(6) A fee payable under regulations made under subsection (1)(b), and any interest payable in respect of it, is recoverable summarily (or, in Scotland, recoverable) as a civil debt.

(7) The regulations may—

(a) make different provision for different purposes;

(b) make transitional, transitory or saving provision.

(8) Regulations under this section are subject to the negative resolution procedure.

Duty to remove person from the DVS register

40

(1) The Secretary of State must remove a person from the DVS register if the person—

(a) asks to be removed from the register,

(b) ceases to provide all of the digital verification services in respect of which the person is registered in the register, or

(c) no longer holds a certificate from an accredited conformity assessment body certifying that at least one of those digital verification services is provided in accordance with the DVS trust framework.

(2) For the purposes of subsection (1)(c), a certificate is to be ignored if—

(a) it has expired in accordance with its terms,

(b) it has been withdrawn by the body that issued it, or

Power to remove person from the DVS register

41

(1) The Secretary of State may remove a person from the DVS register if—

(a) the Secretary of State is satisfied that the person is failing to comply with the DVS trust framework when providing one or more of the digital verification services in respect of which the person is registered,

(b) the person has a supplementary note included in the DVS register and the Secretary of State is satisfied that the person is failing to comply with the supplementary code to which the note relates when providing one or more of the digital verification services recorded in the note,

(c) the Secretary of State is satisfied that the person has failed to provide the Secretary of State with information in accordance with a notice under section 51, or

(d) the Secretary of State considers that it is necessary to do so in the interests of national security.

(2) Before removing a person from the DVS register under this section the Secretary of State must, by written notice, inform the person that the Secretary of State intends to do so.

(3) The notice must—

(a) state the name and address of the person,

(b) state the reason why the Secretary of State—

(i) is satisfied that the person is failing or has failed as mentioned in subsection (1)(a) to (c), or

(ii) considers that it is necessary to remove the person from the DVS register in the interests of national security,

(c) state whether the Secretary of State intends to specify a period in the notice under subsection (8) and, if so, what period is intended to be specified,

(d) state that the person may make written representations to the Secretary of State about—

(i) the Secretary of State’s intention to remove the person from the DVS register, and

(ii) where relevant, the period the Secretary of State intends to specify in the notice under subsection (8), and

(e) specify the period within which such representations may be made.

(4) The requirement in subsection (3)(b) does not apply if, or to the extent that, the Secretary of State considers that stating the reason described in subsection (3)(b)(ii) would be contrary to the interests of national security.

(5) The period specified for making written representations must be a period of not less than 21 days beginning with the day on which the notice is given.

(6) If the Secretary of State considers that it is appropriate for the person to have an opportunity to make oral representations about the matters mentioned in subsection (3)(d), the notice must also—

(a) state that the person may make such representations, and

(b) specify the arrangements for making such representations and the time at which, or the period within which, they may be made.

(7) When deciding whether to remove the person from the DVS register under this section, the Secretary of State must consider any oral or written representations made by the person in accordance with the notice.

(8) Where the Secretary of State removes the person from the DVS register under this section, the Secretary of State must by written notice inform the person of that.

(9) The Secretary of State may, in the notice given under subsection (8), state that any application for re-registration made by the person during a period specified in the notice will be refused.

(10) If the person applies to be re-registered during the period specified in the notice in reliance on subsection (9), the Secretary of State must refuse the application.

(11) The period specified in the notice in reliance on subsection (9) must begin with the day on which the notice is given and must not exceed two years.

Duty to remove services from the DVS register

42

(1) Where a person is registered in the DVS register in respect of digital verification services, subsection (2) applies if the person—

(a) asks for the register to be amended so that the person is no longer registered in respect of one or more of those services,

(b) ceases to provide one or more of those services (but not all of them), or

(c) no longer holds a certificate from an accredited conformity assessment body certifying that all of those services are provided in accordance with the DVS trust framework.

(2) The Secretary of State must amend the register to record that the person is no longer registered in respect of (as the case may be)—

(a) the service or services mentioned in a request described in subsection (1)(a),

(b) the service or services which the person has ceased to provide, or

(3) For the purposes of subsection (1)(c), a certificate is to be ignored if—

(a) it has expired in accordance with its terms,

(b) it has been withdrawn by the body that issued it, or

Duty to remove supplementary notes from the DVS register

43

(1) The Secretary of State must remove a supplementary note included in the entry in the DVS register relating to a person if—

(a) the person asks for the note to be removed,

(b) the person ceases to provide all of the digital verification services to which the note relates,

(c) the person no longer holds a certificate from an accredited conformity assessment body certifying that at least one of those digital verification services is provided in accordance with the supplementary code to which the note relates, or

(d) the supplementary code to which the note relates has been withdrawn.

(2) For the purposes of subsection (1)(c), a certificate is to be ignored if—

(a) it has expired in accordance with its terms,

(b) it has been withdrawn by the body that issued it, or

Duty to remove services from supplementary notes

44

(1) Where a person has a supplementary note included in their entry in the DVS register in respect of digital verification services, subsection (2) applies if the person—

(a) asks for the note to be amended so that it no longer records one or more of those services,

(b) ceases to provide one or more of the services recorded in the note (but not all of them), or

(c) no longer holds a certificate from an accredited conformity assessment body certifying that all of the services included in the note are provided in accordance with a supplementary code.

(2) The Secretary of State must amend the supplementary note so it no longer records (as the case may be)—

(a) the service or services mentioned in a request described in subsection (1)(a),

(b) the service or services which the person has ceased to provide, or

(3) For the purposes of subsection (1)(c), a certificate is to be ignored if—

(a) it has expired in accordance with its terms,

(b) it has been withdrawn by the body that issued it, or

Information gateway

Power of public authority to disclose information to registered person

45

(1) This section applies where—

(a) a person is registered in the DVS register, and

(b) an individual makes a request to the person for the provision of digital verification services in respect of which the person is registered.

(2) A public authority may disclose to the person information relating to the individual for the purpose of enabling the person to provide the digital verification services for the individual.

(3) A disclosure of information under this section does not breach—

(a) any obligation of confidence owed by the public authority making the disclosure, or

(b) any other restriction on the disclosure of information (however imposed).

(4) But this section does not authorise a disclosure of information which—

(a) would contravene the data protection legislation (but in determining whether a disclosure would do so, the power conferred by this section is to be taken into account), or

(b) is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.

(5) This section does not authorise a public authority to disclose information obtained by the authority otherwise than in connection with the exercise by the authority of functions of a public nature.

(6) This section does not affect a power to disclose information that exists apart from this section.

(7) A public authority may charge a person fees in respect of the disclosure to the person of information under this section.

(8) In this section—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3(9) of that Act);

“public authority” means a person whose functions—are of a public nature, orinclude functions of that nature.

Information disclosed by the Revenue and Customs

46

(1) This section applies where the Revenue and Customs disclose personal information to a person under section 45 for the purpose of enabling the person to provide digital verification services for an individual.

(2) The person must not further disclose the information otherwise than for the purpose of providing digital verification services for the individual, except with the consent of the Commissioners for His Majesty’s Revenue and Customs.

(3) Any other person who receives the information, whether directly or indirectly from the person to whom the Revenue and Customs disclose the information, must not further disclose the information, except with the consent of the Commissioners for His Majesty’s Revenue and Customs.

(4) If a person discloses information in contravention of this section, section 19 of the Commissioners for Revenue and Customs Act 2005 (offence of wrongful disclosure) applies in relation to that disclosure as it applies in relation to a disclosure of information in contravention of section 20(9) of that Act.

(5) In this section—

“personal information” means information relating to a person whose identity—is specified in the information, orcan be deduced from it;

“the Revenue and Customs” has the meaning given by section 17(3) of the Commissioners for Revenue and Customs Act 2005.

Information disclosed by the Welsh Revenue Authority

47

(1) This section applies where the Welsh Revenue Authority discloses personal information to a person under section 45 for the purpose of enabling the person to provide digital verification services for an individual.

(2) The person must not further disclose the information otherwise than for the purpose of providing digital verification services for the individual, except with the consent of the Welsh Revenue Authority.

(3) Any other person who receives the information, whether directly or indirectly from the person to whom the Welsh Revenue Authority discloses the information, must not further disclose the information, except with the consent of the Welsh Revenue Authority.

(4) A person who discloses information in contravention of subsection (2) or (3) commits an offence.

(5) It is a defence for a person charged with an offence under subsection (4) to prove that the person reasonably believed—

(a) that the disclosure was lawful, or

(b) that the information had already lawfully been made available to the public.

(6) A person who commits an offence under subsection (4) is liable—

(a) on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);

(b) on summary conviction in Scotland, to imprisonment for a term not exceeding 12 months or a fine not exceeding the statutory maximum (or both);

(c) on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both);

(d) on conviction on indictment, to imprisonment for a term not exceeding 2 years or a fine (or both).

(7) In this section, “personal information” means information relating to a person whose identity—

(a) is specified in the information, or

(b) can be deduced from it.

Information disclosed by Revenue Scotland

48

(1) This section applies where Revenue Scotland discloses personal information to a person under section 45 for the purpose of enabling the person to provide digital verification services for an individual.

(2) The person must not further disclose the information otherwise than for the purpose of providing digital verification services for the individual, except with the consent of Revenue Scotland.

(3) Any other person who receives the information, whether directly or indirectly from the person to whom Revenue Scotland discloses the information, must not further disclose the information, except with the consent of Revenue Scotland.

(4) A person who discloses information in contravention of subsection (2) or (3) commits an offence.

(5) It is a defence for a person charged with an offence under subsection (4) to prove that the person reasonably believed—

(a) that the disclosure was lawful, or

(b) that the information had already lawfully been made available to the public.

(6) A person who commits an offence under subsection (4) is liable—

(a) on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);

(b) on summary conviction in Scotland, to imprisonment for a term not exceeding 12 months or a fine not exceeding the statutory maximum (or both);

(c) on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both);

(d) on conviction on indictment, to imprisonment for a term not exceeding 2 years or a fine (or both).

(7) In this section, “personal information” means information relating to a person whose identity—

(a) is specified in the information, or

(b) can be deduced from it.

Code of practice about the disclosure of information

49

(1) The Secretary of State must prepare and publish a code of practice about the disclosure of information under section 45.

(2) The code of practice must be consistent with the code of practice prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act (as altered or replaced from time to time).

(3) A public authority must have regard to the code of practice in disclosing information under section 45.

(4) The Secretary of State may from time to time revise and republish the code of practice.

(5) In preparing or revising the code of practice, the Secretary of State must consult—

(a) the Information Commissioner,

(b) the Welsh Ministers,

(d) the Department of Finance in Northern Ireland, and

(e) such other persons as the Secretary of State considers appropriate.

(6) The requirement in subsection (5) may be satisfied by consultation undertaken before the coming into force of this section.

(7) The Secretary of State may not publish the first version of the code of practice unless a draft of the code has been laid before, and approved by a resolution of, each House of Parliament.

(8) The Secretary of State may not republish the code of practice following its revision unless—

(a) a draft of the code as revised has been laid before each House of Parliament, and

(b) the 40-day period has expired without either House of Parliament resolving not to approve the draft.

(9) “The 40-day period” means—

(a) the period of 40 days beginning with the day on which the draft is laid before Parliament, or

(b) if the draft is not laid before each House on the same day, the period of 40 days beginning with the later of the days on which it is laid before Parliament.

(10) In calculating the 40-day period, no account is to be taken of any whole days that fall within a period during which Parliament is dissolved or prorogued or during which both Houses are adjourned for more than 4 days.

(11) In this section, “public authority” means a person whose functions—

(a) are of a public nature, or

(b) include functions of that nature.

Trust mark

Trust mark for use by registered persons

50

(1) The Secretary of State may designate a mark for use in the course of providing, or offering to provide, digital verification services.

(2) A mark designated under this section must be published by the Secretary of State.

(3) A mark designated under this section may not be used by a person in the course of providing, or offering to provide, digital verification services unless the person is registered in the DVS register in respect of those digital verification services.

(4) The Secretary of State may enforce subsection (3) in civil proceedings for an injunction or, in Scotland, an interdict.

Supplementary

Power of Secretary of State to require information

51

(1) The Secretary of State may by written notice require—

(a) an accredited conformity assessment body, or

(b) a person registered in the DVS register,

to provide the Secretary of State with information that the Secretary of State reasonably requires for the purposes of the exercise of the Secretary of State’s functions under this Part.

(2) A notice under this section must state why the information is required for the purposes of the exercise of those functions.

(3) A notice under this section—

(a) may specify or describe particular information or a category of information;

(b) may specify the form in which the information must be provided;

(d) may specify the place where the information must be provided.

(4) A notice under this section that is given to a person registered in the DVS register must provide information about the consequences under section 41 of failure to comply with the notice.

(5) The Secretary of State may cancel a notice under this section by notice to the person to whom it was given.

(6) A disclosure of information required by a notice under this section does not breach—

(a) any obligation of confidence owed by the person making the disclosure, or

(b) any other restriction on the disclosure of information (however imposed).

(7) But a notice under this section does not require a disclosure of information if the disclosure—

(a) would contravene section 46, 47 or 48,

(b) would contravene the data protection legislation (but in determining whether a disclosure would do so, the duty imposed by the notice is to be taken into account), or

(8) A notice under this section does not require a person to provide the Secretary of State with information in respect of a communication which is made—

(a) between a professional legal adviser and the adviser’s client, and

(b) in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under this Part.

(9) In subsection (8), references to the client of a professional legal adviser include references to a person acting on behalf of the client.

(10) A notice under this section does not require a person to provide the Secretary of State with information if doing so would, by revealing evidence of the commission of an offence, expose the person to proceedings for that offence.

(11) The reference to an offence in subsection (10) does not include an offence under—

(a) section 5 of the Perjury Act 1911 (false statements made otherwise than on oath);

(b) section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath);

(c) Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).

(12) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3(9) of that Act).

Arrangements for third party to exercise functions

52

(1) The Secretary of State may make arrangements for a person prescribed by regulations under this section to exercise a relevant function of the Secretary of State (and, where arrangements are made, references in this Part, or in regulations made under this Part, to the Secretary of State are to be read accordingly).

(2) Arrangements under this section may—

(a) provide for the Secretary of State to make payments to the person, and

(b) make provision as to the circumstances in which any such payments are to be repaid to the Secretary of State.

(3) Regulations under this section are subject to the affirmative resolution procedure.

(4) In this section, “relevant function” means a function of the Secretary of State conferred by or under this Part (including the function of charging or recovering fees under regulations under section 39) other than a power to make regulations.

(5) If a person exercises the function of charging or recovering fees by virtue of arrangements under this section, the person must pay the fees to the Secretary of State, except to the extent that the Secretary of State directs otherwise.

Report on the operation of this Part

53

(1) The Secretary of State must prepare and publish reports on the operation of this Part.

(2) The first report must be published within the period of 12 months beginning with the day on which section 28 comes into force.

(3) The reports must be published not more than 12 months apart.

Index of defined terms for this Part

54

The Table below lists provisions that define or otherwise explain terms defined for the purposes of this Part.

Term	Provision
accredited conformity assessment body	section 33 (6)
digital verification services	section 27 (2)
the DVS register	section 32 (2)
the DVS trust framework	section 28 (1)
supplementary code	section 29 (2)
supplementary note	section 36 (6)

Powers relating to verification of identity or status

55

(1) In section 15 of the Immigration, Asylum and Nationality Act 2006 (penalty for employing a person subject to immigration control), after subsection (7) insert—

(8) An order under subsection (3) containing provision described in subsection (7)(a), (b) or (c) may, in particular— (a) specify a document generated by a DVS-registered person or a DVS-registered person of a specified description; (b) specify a document which was provided to such a person in order to generate such a document; (c) specify steps involving the use of services provided by such a person. (9) In subsection (8), “DVS-registered person” means a person who is registered in the DVS register maintained under Part 2 of the Data (Use and Access) Act 2025 (“the DVS register”). (10) An order under subsection (3) which specifies a description of DVS-registered person may do so by, for example, describing a DVS-registered person whose entry in the DVS register includes a note relating to specified services (see section 36 of the Data (Use and Access) Act 2025).

(2) In section 34 of the Immigration Act 2014 (requirements which may be prescribed for the purposes of provisions about occupying premises under a residential tenancy agreement)—

(a) in subsection (1)—

(i) in paragraph (a), after “occupiers” insert “, a DVS-registered person or a DVS-registered person of a prescribed description”,

(ii) in paragraph (b), after “occupiers” insert “, a DVS-registered person or a DVS-registered person of a prescribed description”, and

(iii) in paragraph (c), at the end insert “, including steps involving the use of services provided by a DVS-registered person or a DVS-registered person of a prescribed description”, and

(b) after that subsection insert—

(1A) An order prescribing requirements for the purposes of this Chapter which contains provision described in subsection (1)(a) or (b) may, in particular— (a) prescribe a document generated by a DVS-registered person or a DVS-registered person of a prescribed description; (b) prescribe a document which was provided to such a person in order to generate such a document. (1B) In subsections (1) and (1A), “DVS-registered person” means a person who is registered in the DVS register maintained under Part 2 of the Data (Use and Access) Act 2025 (“the DVS register”). (1C) An order prescribing requirements for the purposes of this Chapter which prescribes a description of DVS-registered person may do so by, for example, describing a DVS-registered person whose entry in the DVS register includes a note relating to prescribed services (see section 36 of the Data (Use and Access) Act 2025).

(3) In Schedule 6 to the Immigration Act 2016 (illegal working compliance orders etc), after paragraph 5 insert—

(5A) (1) Regulations under paragraph 5(6)(b) or (c) may, in particular— (a) prescribe checks carried out using services provided by a DVS-registered person or a DVS-registered person of a prescribed description; (b) prescribe documents generated by such a person; (c) prescribe documents which were provided to such a person in order to generate such documents. (2) In sub-paragraph (1), “DVS-registered person” means a person who is registered in the DVS register maintained under Part 2 of the Data (Use and Access) Act 2025 (“the DVS register”). (3) Regulations under paragraph 5(6)(b) or (c) which prescribe a description of DVS-registered person may do so by, for example, describing a DVS-registered person whose entry in the DVS register includes a note relating to prescribed services (see section 36 of the Data (Use and Access) Act 2025).

Part 3 — National Underground Asset Register

National Underground Asset Register: England and Wales

56

(1) After section 106 of the New Roads and Street Works Act 1991 insert—

(106A) (1) The Secretary of State must keep a register of information relating to apparatus in streets in England and Wales. (2) The register is to be known as the National Underground Asset Register (and is referred to in this Act as “NUAR”). (3) NUAR must be kept in such form and manner as may be prescribed. (4) The Secretary of State must make arrangements so as to enable any person who is required, by a provision of this Act, to enter information into NUAR to have access to NUAR for that purpose. (5) Regulations under subsection (3) are subject to the negative procedure. (6) The obligations of the Secretary of State under subsection (1) and under Article 45A(1) of the Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)) (keeping of register of information relating to apparatus in streets in Northern Ireland) may be discharged by the keeping of a single register in relation to England, Wales and Northern Ireland. (106B) (1) Before the end of the initial upload period an undertaker having apparatus in a street must enter into NUAR— (a) all information that is included in the undertaker’s records under section 79(1) on the archive upload date, and (b) any other information of a prescribed description that is held by the undertaker on that date. (2) The duty under subsection (1) does not apply in such cases as may be prescribed. (3) Information must be entered into NUAR under subsection (1) in such form and manner as may be prescribed. (4) An undertaker who fails to comply with a duty placed on the undertaker under this section— (a) commits an offence, and (b) is liable to compensate any person in respect of damage or loss incurred by the person in consequence of the failure. (5) A person who commits an offence under subsection (4)(a) is liable on summary conviction to a fine. (6) In criminal or civil proceedings against an undertaker arising out of a failure to comply with a duty under this section, it is a defence for the undertaker to show that all reasonable care was taken to secure that no such failure occurred by— (a) the undertaker and the undertaker’s employees, and (b) any contractor of the undertaker and the contractor’s employees. (7) Section 95 applies in relation to an offence under this section as it applies in relation to an offence under Part 3. (8) For the purposes of subsection (1) the Secretary of State must by regulations— (a) specify a date as “the archive upload date”, and (b) specify a period beginning with that date as the “initial upload period”. (9) Regulations under this section are subject to the negative procedure. (106C) (1) The Secretary of State may by regulations make provision for or in connection with making information kept in NUAR available. (2) The regulations may (among other things)— (a) make provision about which information, or descriptions of information, may be made available; (b) make provision about the descriptions of person to whom information may be made available; (c) make provision for information to be made available subject to exceptions; (d) make provision requiring or authorising the Secretary of State to adapt, modify or obscure information before making it available; (e) make provision authorising all information kept in NUAR to be made available to prescribed descriptions of person under prescribed conditions; (f) make provision about the purposes for which information may be made available; (g) make provision about the form and manner in which information may be made available; (h) make provision for or in connection with the granting of licences by the Secretary of State in relation to any non-Crown IP rights that may exist in relation to information made available (including provision about the form of a licence and the terms and conditions of a licence); (i) make provision for information to be made available for free or for a fee; (j) make provision about the amounts of the fees, including provision for the amount of a fee to be an amount which is intended to exceed the cost of the things in respect of which the fee is charged; (k) make provision about how funds raised by means of fees must or may be used, including provision for funds to be paid to persons who are required, by a provision of this Act, to enter information into NUAR. (3) Except as otherwise prescribed and subject to section 106I, processing of information by the Secretary of State in exercise of functions conferred by or under section 106A or this section does not breach— (a) an obligation of confidence owed by the Secretary of State, or (b) any other restriction on the processing of information (however imposed). (4) Regulations under this section are subject to the affirmative procedure. (5) In this section— - “database right” has the same meaning as in Part 3 of the Copyright and Rights in Databases Regulations 1997 (S.I. 1997/3032); - “non-Crown IP right” means any copyright, database right or other intellectual property right which is not owned by the Crown. (106D) (1) The Secretary of State must produce guidance for persons described in subsection (2) about how to protect information kept in, or obtained from, NUAR. (2) The persons are persons who, pursuant to regulations made under section 106C, are able to access information kept in NUAR. (3) The Secretary of State may revise or replace the guidance. (4) The Secretary of State must publish the guidance (and any revised or replacement guidance) in such manner as the Secretary of State considers appropriate for bringing it to the attention of persons described in subsection (2). (5) The same guidance may discharge the obligations of the Secretary of State under this section and under Article 45D of the Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)). (106E) (1) The Secretary of State may by regulations make provision requiring undertakers having apparatus in a street to pay fees to the Secretary of State for or in connection with the exercise by the Secretary of State of any function conferred by or under this Part. (2) The regulations may— (a) specify the amounts of the fees, or the maximum amounts of the fees, or (b) provide for the amounts of the fees, or the maximum amounts of the fees, to be determined in accordance with the regulations. (3) In making the regulations the Secretary of State must seek to secure that, so far as possible and taking one year with another, combined NUAR income matches combined NUAR expenses. (4) Except where the regulations specify the amounts of the fees— (a) the amounts of the fees must be specified by the Secretary of State in a statement, and (b) the Secretary of State must— (i) publish the statement, and (ii) lay it before Parliament. (5) Regulations under subsection (1) may make provision about— (a) when a fee is to be paid; (b) the manner in which a fee is to be paid; (c) the payment of discounted fees; (d) exceptions to requirements to pay fees; (e) the refund of all or part of a fee which has been paid. (6) Before making regulations under subsection (1), the Secretary of State must consult— (a) such representatives of persons likely to be affected by the regulations as the Secretary of State considers appropriate, and (b) such other persons as the Secretary of State considers appropriate. (7) Subject to the following provisions of this section regulations under subsection (1) are subject to the affirmative procedure. (8) Regulations under subsection (1) that only make provision of a kind mentioned in subsection (2) are subject to the negative procedure. (9) But the first regulations under subsection (1) that make provision of a kind mentioned in subsection (2) are subject to the affirmative procedure. (10) In this section— - “combined NUAR expenses” means the sum of—expenses incurred by the Secretary of State in, or in connection with, exercising functions conferred by or under this Part (including expenses not directly connected with the keeping of NUAR), andexpenses incurred by the Secretary of State in, or in connection with, exercising functions conferred by or under Articles 45A to 45I of, and Schedule 2ZA to, the Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)) (including expenses not directly connected with the keeping of the register kept under Article 45A(1) of that Order); - “combined NUAR income” means the sum of—income received by the Secretary of State from fees payable under regulations under subsection (1), andincome received by the Secretary of State from fees payable under regulations under Article 45E(1) of the Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)). (106F) (1) The Secretary of State may by regulations make provision requiring undertakers having apparatus in a street to provide information to the Secretary of State for either or both of the following purposes— (a) assisting the Secretary of State in determining the provision that it is appropriate for regulations under section 106E(1) or a statement under section 106E(4) to make; (b) assisting the Secretary of State in determining whether it is appropriate to make changes to such provision. (2) The Secretary of State may by regulations make provision requiring undertakers having apparatus in a street to provide information to the Secretary of State for either or both of the following purposes— (a) ascertaining whether a fee is payable by a person under regulations under section 106E(1); (b) working out the amount of a fee payable by a person. (3) Regulations under subsection (1) or (2) may require an undertaker to notify the Secretary of State of any changes to information previously provided under the regulations. (4) Regulations under subsection (1) or (2) may make provision about— (a) when information is to be provided (which may be at prescribed intervals); (b) the form and manner in which information is to be provided; (c) exceptions to requirements to provide information. (5) Regulations under subsection (1) or (2) are subject to the negative procedure. (106G) Schedule 5A makes provision about the imposition of penalties in connection with requirements imposed by regulations under sections 106E(1) and 106F(1) and (2). (106H) (1) The Secretary of State may make arrangements for a prescribed person to exercise a relevant function of the Secretary of State. (2) More than one person may be prescribed. (3) Arrangements under this section may— (a) provide for the Secretary of State to make payments to the person, and (b) make provision as to the circumstances in which such payments are to be repaid to the Secretary of State. (4) In the case of the exercise of a function by a person authorised by arrangements under this section to exercise that function, a reference in this Part or in regulations under this Part to the Secretary of State in connection with that function is to be read as a reference to that person. (5) Arrangements under this section do not prevent the Secretary of State from exercising a function to which the arrangements relate. (6) Except as otherwise prescribed and subject to section 106I, the disclosure of information between the Secretary of State and a person in connection with the person’s entering into arrangements under this section or exercise of functions to which such arrangements relate does not breach— (a) an obligation of confidence owed by the person making the disclosure, or (b) any other restriction on the disclosure of information (however imposed). (7) Regulations under this section are subject to the affirmative procedure. (8) In this section “relevant function” means a function of the Secretary of State conferred by or under this Part (including the function of charging or recovering fees under regulations under section 106E) other than— (a) a power to make regulations, or (b) a function under section 106E(4) (specifying of fees etc). (9) If a person exercises the function of charging or recovering fees by virtue of arrangements under this section, the person must pay the fees to the Secretary of State, except to the extent that the Secretary of State directs otherwise. (106I) (1) A duty or power to process information that is imposed or conferred by or under this Part does not operate to require or authorise the processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, that duty or power is to be taken into account). (2) In this section— - “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3(9) of that Act); - “personal data” has the same meaning as in that Act (see section 3(2) of that Act). (106J) (1) In this Part “prescribed” means prescribed by regulations made by the Secretary of State. (2) Regulations under this Part may make— (a) different provision for different purposes; (b) supplementary and incidental provision. (3) Regulations under this Part are to be made by statutory instrument. (4) Before making regulations under this Part the Secretary of State must obtain the consent of the Welsh Ministers in relation to any provision which would be within the legislative competence of Senedd Cymru if contained in an Act of the Senedd (ignoring any requirement for the consent of a Minister of the Crown imposed under Schedule 7B to the Government of Wales Act 2006). (5) Where regulations under this Part are subject to “the affirmative procedure” the regulations may not be made unless a draft of the statutory instrument containing them has been laid before and approved by a resolution of each House of Parliament. (6) Where regulations under this Part are subject to “the negative procedure” the statutory instrument containing the regulations is subject to annulment in pursuance of a resolution of either House of Parliament. (7) Any provision that may be made in regulations under this Part subject to the negative procedure may be made in regulations subject to the affirmative procedure. (106K) (1) In this Part the following terms have the same meaning as in Part 3— - “apparatus” (see sections 89(3) and 105(1)); - “in” (in a context referring to apparatus in a street) (see section 105(1)); - “street” (see section 48(1) and (2)); - “undertaker” (in relation to apparatus or in a context referring to having apparatus in a street) (see sections 48(5) and 89(4)). (2) In this Part “processing” has the same meaning as in the Data Protection Act 2018 (see section 3(4) of that Act) and “process” is to be read accordingly.

(2) Section 166 of the New Roads and Street Works Act 1991, so far as relating to Part 3A of that Act (inserted by subsection (1)), extends to England and Wales.

(3) In section 167 of that Act (Crown application), after subsection (5) insert—

(5A) The provisions of Part 3A of this Act (National Underground Asset Register: England and Wales) bind the Crown. (5B) Nothing in subsection (5A) is to be construed as authorising the bringing of proceedings for a criminal offence against a person acting on behalf of the Crown.

(4) Schedule 1 to this Act inserts Schedule 5A into the New Roads and Street Works Act 1991 (monetary penalties).

Information in relation to apparatus: England and Wales

57

(1) The New Roads and Street Works Act 1991 is amended in accordance with subsections (2) to (6).

(2) For the italic heading before section 79 (records of location of apparatus) substitute “Duties in relation to recording and sharing of information about apparatus”.

(3) In section 79—

(a) for the heading substitute “Information in relation to apparatus”;

(b) in subsection (1), for paragraph (c) substitute—

(c) being informed of its location under section 80(2)(a),

;

(1B) An undertaker must, except in such cases as may be prescribed, record in relation to every item of apparatus belonging to the undertaker such other information as may be prescribed as soon as reasonably practicable after— (a) placing the item in the street or altering its position, (b) inspecting, maintaining, adjusting, repairing, altering or renewing the item, (c) locating the item in the street in the course of executing any other works, or (d) receiving any such information in relation to the item under section 80(2)(a).

;

(d) omit subsection (3);

(e) in subsection (3A) (as inserted by section 46(4) of the Traffic Management Act 2004)—

(i) for “to (3)” substitute “and (2A)”;

(ii) for “subsection (1)” substitute “this section”;

(f) after subsection (3A) insert—

(3B) Except in such cases as may be prescribed, where an undertaker records information as required by subsection (1) or (1B), or updates such information, the undertaker must, within a prescribed period, enter the recorded or updated information into NUAR. (3C) Information must be entered into NUAR under subsection (3B) in such form and manner as may be prescribed.

;

(g) in subsection (4)(a), omit “not exceeding level 5 on the standard scale”;

(h) after subsection (6) insert—

(7) In this section “prescribed” means— (a) in subsections (1) to (2)— (i) in relation to apparatus in streets in England, prescribed by regulations made by the Secretary of State; (ii) in relation to apparatus in streets in Wales, prescribed by regulations made by the Secretary of State or the Welsh Ministers; (b) otherwise, prescribed by regulations made by the Secretary of State. (8) Before making regulations under this section the Secretary of State must obtain the consent of the Welsh Ministers in relation to any provision that relates to apparatus in streets in Wales. (9) For the meaning of “NUAR”, see section 106A.

(4) For section 80 (duty to inform undertakers of location of apparatus) substitute—

(80) (1) Subsection (2) applies where a relevant person executing works of any description in a street finds an item of apparatus which does not belong to the person in relation to which prescribed information— (a) is not entered in NUAR, or (b) is entered in NUAR but is incorrect. (2) Except in such cases as may be prescribed, the person must— (a) take such steps as are reasonably practicable to inform the undertaker to whom the item belongs of the missing or incorrect information, and (b) if (having taken such steps) the person is unable to inform the undertaker to whom the item belongs of the missing or incorrect information, enter into NUAR, in such form and manner as may be prescribed, prescribed information in relation to the item. (3) A person who fails to comply with subsection (2) commits an offence. (4) A person who commits an offence under subsection (3) is liable on summary conviction to a fine not exceeding level 4 on the standard scale. (5) Before making regulations under this section the Secretary of State must obtain the consent of the Welsh Ministers in relation to any provision that relates to apparatus in streets in Wales. (6) Before making regulations under this section the Secretary of State must consult— (a) such representatives of persons likely to be affected by the regulations as the Secretary of State considers appropriate, and (b) such other persons as the Secretary of State considers appropriate. (7) For the purposes of this section a person executing works in a street is a “relevant person” if the person has, pursuant to regulations under section 106C(1), access to NUAR in relation to the street in question. (8) For the meaning of “NUAR”, see section 106A.

(5) Before section 81 (duty to maintain apparatus) insert—

(6) In section 104 (regulations)—

(a) in subsection (1)—

(i) after “Part” insert “, except in section 79,”;

(ii) omit from “, which” to the end;

(b) after subsection (1) insert—

(1A) Regulations under this Part may make— (a) different provision for different cases; (b) supplementary or incidental provision.

;

(d) after subsection (2) insert—

(2A) Regulations made by the Welsh Ministers under section 79 are to be made by statutory instrument and a statutory instrument containing such regulations is subject to annulment in pursuance of a resolution of Senedd Cymru.

(7) In consequence of the provision made by subsection (4), omit section 47 of the Traffic Management Act 2004.

(8) In Schedule 7B to the Government of Wales Act 2006 (general restriction on competence of Senedd Cymru), in paragraph 11(6)(b) (exceptions to restrictions relating to Ministers of the Crown), before sub-paragraph (i) insert—

(ai) section 79 of the New Roads and Street Works Act 1991;

National Underground Asset Register: Northern Ireland

58

(1) The Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)) is amended in accordance with subsections (2) to (4).

(2) In Article 2 (interpretation), in paragraph (2)—

(a) after the definition of “in” insert—

“NUAR provision” means any of Articles 45A to 45I and Schedule 2ZA;

;

(b) in the definition of “prescribed”—

(i) for “means” substitute “means—”;

(ii) the words from “prescribed by” to the end become paragraph (a);

(iii) at the beginning of that paragraph insert “except in Articles 39 and 40 and a NUAR provision,”;

(iv) after that paragraph insert—

in Article 40 and a NUAR provision, prescribed by regulations made by the Secretary of State;

(3) After Article 45

insert—

Reading this document does not replace reading the official text published on legislation.gov.uk. Contains public sector information licensed under the Open Government Licence v3.0. We assume no responsibility for any inaccuracies arising from the conversion of the original CLML XML to this format.

This text is published under legislation.gov.uk's own terms of reuse, not a Legalize or public-domain licence. legislation.gov.uk
Open Government Licence v3.0 (attribution required)
© Crown and database right. Derived from content available under the Open Government Licence v3.0 from legislation.gov.uk.