Data (Use and Access) Act 2025

• (a) in the opening words, for “section” substitute “Chapter”,

• (b) after the definition of “health care” insert—

• “information technology” includes— computers, other devices whose uses include the processing of information by electronic means (“IT devices”), parts, accessories and other equipment made or adapted for use in connection with computers or IT devices, software and code made or adapted for use in connection with computers or IT devices, and networks and other infrastructure (whether physical or virtual) used in connection with other information technology;
• “IT service” means an information technology service, including any service (whether physical or virtual) which consists of, or is provided in connection with, the development, making available, operation or maintenance of information technology;

,

• (c) in the definition of “processing”, omit “and (14)”, and

• (d) at the end insert—

• “relevant IT provider” means a person involved in marketing, supplying, providing or otherwise making available— information technology, an IT service, or a service which consists of processing information using information technology, whether for payment or free of charge, but only so far as the technology or service is used, or intended to be used, in connection with the provision in, or in relation to, England of health care or of adult social care.

4

After section 250 insert—

(250A) (1) An information standard relating to information technology or IT services may, among other things, make provision about— (a) the design, quality, capabilities or other characteristics of such technology or services; (b) contracts or other arrangements under which such technology or services are marketed, supplied, provided or otherwise made available. (2) An information standard may include technical provision about information technology or IT services, including provision about— (a) functionality; (b) connectivity; (c) interoperability; (d) portability; (e) storage of, and access to, information; (f) security of information. (3) An information standard may make provision by reference to open standards or proprietary standards.

5

• (1) Section 251 (information standards: procedure etc) is amended as follows.

• (2) In the heading omit “Information standards:”.

• (3) For subsection (3) substitute—

(3) The power under section 250(1) may be exercised by— (a) adopting an information standard prepared or published by another person, including as it has effect from time to time, or (b) making provision by reference to an international agreement or another document, including as it has effect from time to time.

6

After section 251 insert—

.

7

For the heading of section 251ZA (information standards: compliance) substitute “Monitoring compliance”.

8

After that section insert—

(251ZB) (1) If the Secretary of State has reasonable grounds to suspect that a relevant IT provider is not complying with an information standard which applies to the provider, the Secretary of State may give the provider a written notice which— (a) identifies the standard in question, (b) sets out the Secretary of State’s grounds for suspecting that the provider is not complying with the standard, (c) asks the provider to comply with the standard within a period specified in the notice, (d) asks the provider, within a period specified in the notice, to provide evidence to the Secretary of State’s satisfaction that the provider is complying with the standard, and (e) if the Secretary of State considers it appropriate, sets out the steps that the Secretary of State considers the provider must take, within a period specified in the notice, in order to comply with the standard. (2) A period specified for the purposes of subsection (1)(c), (d) or (e) must be a period of at least 28 days beginning with the day on which the notice is given. (3) The Secretary of State may, by giving the relevant IT provider a further written notice, vary or revoke a notice given under subsection (1). (251ZC) (1) If the Secretary of State has reasonable grounds to suspect that a relevant IT provider is not complying with an information standard which applies to the provider, the Secretary of State may publish a statement to that effect. (2) The statement may include the text of a notice given to the provider under section 251ZB. (3) Before publishing a statement under this section, the Secretary of State must give the relevant IT provider— (a) a copy of the terms of the proposed statement, and (b) an opportunity to make representations about the decision to publish a statement and the terms of the statement. (4) If, after considering any representations, the Secretary of State decides to publish the statement, the Secretary of State must inform the relevant IT provider before publishing it. (5) This section does not authorise the processing of information if the processing would contravene the data protection legislation (but in determining whether it would do so, take into account the power conferred by this section). (6) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act). (251ZD) (1) The Secretary of State may— (a) direct a public body to exercise some or all of the functions listed in subsection (3), and (b) give the public body directions about the exercise of those functions, including directions about the processing of information that the body obtains in exercising those functions. (2) The Secretary of State may make arrangements for a person prescribed by regulations under this subsection to exercise some or all of the functions listed in subsection (3). (3) Those functions are— (a) the Secretary of State’s functions under section 251ZA, so far as they relate to relevant IT providers, and (b) the Secretary of State’s functions under section 251ZB. (4) Arrangements under subsection (2) may— (a) provide for the Secretary of State to make payments to the person, and (b) make provision as to the circumstances in which such payments are to be repaid to the Secretary of State. (5) Section 304(9) applies in relation to the power to make arrangements under subsection (2) as it applies to a power of the Secretary of State to give directions under this Act. (251ZE) (1) Regulations may make provision for the establishment and operation of a scheme for the accreditation of information technology and IT services so far as used, or intended to be used, in connection with the provision in, or in relation to, England of health care or of adult social care. (2) The regulations may provide for the scheme to be established and operated by a person specified in the regulations (“the operator”). (3) The regulations may, among other things, confer power on the operator— (a) to establish the procedure for accreditation under the scheme, (b) to set the criteria for accreditation under the scheme (“the accreditation criteria”), (c) to keep an accreditation under the scheme under review, and (d) to charge a reasonable fee in respect of an application for accreditation. (4) The regulations may, among other things, make provision requiring the operator— (a) to set some or all of the accreditation criteria by reference to information standards, (b) to publish details of the scheme, including the accreditation criteria, (c) to provide for the review of a decision to refuse an application for accreditation, and (d) to provide advice to applicants for accreditation with a view to ensuring that the accreditation criteria are met.

Schedule 16

Part 1 — Amendments of the Energy Act 2008

1

The Energy Act 2008 is amended as follows.

2

In the italic heading before section 88, after “meters” insert “: modification of licence conditions etc by Secretary of State”.

3

After section 91 insert—

(91A) (1) The Gas and Electricity Markets Authority may by regulations make provision about the procedure to be followed in relation to the grant of a smart meter communication licence. (2) Regulations under subsection (1) may provide that the procedure is to consist of either (but not both) of the following— (a) a determination by the Authority, on a competitive basis, of the person to whom a licence is to be granted; (b) the selection by the Authority, on a non-competitive basis, of the person to whom a licence is to be granted. (3) Regulations under subsection (1) may make provision by reference to a determination by the Authority or to the opinion of the Authority as to any matter. (4) The approval of the Secretary of State is required for the making of regulations under subsection (1). (5) In this section and in sections 91B to 91D— - “the Authority” means the Gas and Electricity Markets Authority; - “smart meter communication licence” means a licence under section 7AB of the Gas Act 1986 or a licence under section 6(1)(f) of the Electricity Act 1989. (91B) (1) Regulations under section 91A(1)— (a) must make provision so as to ensure that a smart meter communication licence must not be granted to a person unless the Authority is satisfied that the person would not, if granted the licence, have a financial or other interest likely to prejudice the discharge of their functions as the licence holder; (b) may make provision about the granting of a licence to a person formed by the Authority. (2) Any sums received by the Authority under regulations under section 91A(1) are to be paid into the Consolidated Fund. (3) Regulations made in reliance on section 91A(2)(a) may— (a) provide for the publication of a proposal to grant a smart meter communication licence; (b) provide for the inclusion in such a proposal of an invitation to apply for such a licence; (c) impose conditions in relation to the making of an application for a licence; (d) impose restrictions in relation to persons who may apply for a licence; (e) impose requirements as to the period within which applications must be made; (f) make provision for regulating the manner in which applications are to be considered or determined; (g) confer on the Authority functions in connection with tender exercises. (4) Regulations in reliance on section 91A(2)(a) may also include provision— (a) enabling the Authority to require payments to be made, in the form and manner prescribed, in respect of costs incurred or likely to be incurred by the Authority for the purposes of a tender exercise; (b) about the effect on a person’s participation in a tender exercise of a failure to comply with a requirement imposed by virtue of paragraph (a); (c) about the circumstances in which the tender exercise is to stop as a result of such a failure. (5) In this section— - “prescribed” means prescribed in or determined under regulations under section 91A(1); - “tender exercise” means the procedure set out in regulations made in reliance on section 91A(2)(a) for determining to whom a particular smart meter communication licence is to be granted. (91C) (1) The Authority may modify— (a) a condition of a particular relevant licence; (b) the standard conditions incorporated in relevant licences of a particular type; (c) a document maintained in accordance with the conditions of a relevant licence, or an agreement that gives effect to a document so maintained. (2) The Authority may exercise the power in subsection (1) only if the Authority considers it necessary or expedient to do so for the purposes of, or in preparation for, the grant of a smart meter communication licence. (3) The power conferred by subsection (1)— (a) may be exercised to make different provision for different purposes or different areas; (b) may be exercised generally, only in relation to specified cases or subject to exceptions (including provision for a case to be excepted only so long as specified conditions are satisfied); (c) includes a power to make incidental, supplementary, consequential or transitional modifications. (4) Provision included in a licence in reliance on subsection (1)— (a) need not relate to the activities authorised by the licence; (b) in the case of a licence for the purposes of section 5 of the Gas Act 1986, may do any of the things authorised by section 7B(5) of that Act (which apply to the Authority’s power with respect to licence conditions under section 7B(4)(a)); (c) in the case of a licence for the purposes of section 4 of the Electricity Act 1989, may do any of the things authorised by section 7(2) to (4) of that Act (which apply to the Authority’s power with respect to licence conditions under section 7(1)(a)). (5) A modification under subsection (1) of part of a standard condition of a licence does not prevent any other part of the condition from continuing to be regarded as a standard condition for the purposes of Part 1 of the Gas Act 1986 or Part 1 of the Electricity Act 1989. (6) Where the Authority makes modifications under subsection (1) of the standard conditions of a licence of any type, the Authority must— (a) make (as nearly as may be) the same modifications of those standard conditions for the purposes of their incorporation in licences of that type granted after that time, and (b) publish the modifications. (7) In this section— - “relevant licence” means a licence for the purposes of section 5 of the Gas Act 1986 or section 4 of the Electricity Act 1989 (prohibitions on unlicensed activities); - “specified” means specified in the modification. (91D) (1) Before making a modification under section 91C, the Authority must consult— (a) the holder of any licence being modified, (b) the Secretary of State, and (c) such other persons as the Authority considers appropriate. (2) Subsection (1) may be satisfied by consultation undertaken before the passing of the Data (Use and Access) Act 2025. (3) If, after carrying out the consultation, the Authority decides to make the modification, it must publish a notice about the decision which— (a) states that the Authority has decided to make the modification; (b) sets out the modification and its effect; (c) specifies the date from which the modification has effect; (d) states how the Authority has taken account of any representations made during the consultation; (e) states the reason for any differences between the modification consulted on and the proposed modification. (4) The notice must be published in such manner as the Authority considers appropriate for bringing it to the attention of those likely to be affected by the making of the modification.

4

In section 104 (subordinate legislation)—

• (a) in subsection (1), for “or the Scottish Ministers” substitute “, the Scottish Ministers or the Gas and Electricity Markets Authority”;

• (b) in subsection (3), at the end insert

, and (c) regulations made by the Gas and Electricity Markets Authority under section 91A.

Part 2 — Amendments of other legislation

Gas Act 1986

5

• (1) The Gas Act 1986 is amended as follows.

• (2) In section 7B (licences: general)—

• (a) omit subsection (2B);

• (b) in subsection (2C), after “for” insert “a smart meter communication licence or”.

• (3) In section 41HC (competitive tenders for licences for new licensable activities), in subsection (1), after “activities” insert “, other than a smart meter communication licence,”.

Electricity Act 1989

6

• (1) The Electricity Act 1989 is amended as follows.

• (2) In section 6A (procedure for licence applications)—

• (a) in subsection (1)(a), for “subsections (1A) and (1B)” substitute “subsection (1B)”;

• (b) omit subsection (1A);

• (c) in subsection (1B), after “for” insert “a smart meter communication licence or”.

• (3) In section 56FC (competitive tenders for licences for new licensable activities), in subsection (1), after “activities” insert “, other than a licence under section 6(1)(f) (smart meter communication licence),”.

Electricity and Gas (Competitive Tenders for Smart Meter Communication Licences) Regulations 2012

7

The Electricity and Gas (Competitive Tenders for Smart Meter Communication Licences) Regulations 2012 (S.I. 2012/2414) are revoked.

Customer data and business data

Power to make provision in connection with customer data

Customer data: supplementary

Power to make provision in connection with business data

Business data: supplementary

Decision-makers

Interface bodies

Enforcement of regulations under this Part

Restrictions on powers of investigation etc

Financial penalties

Fees

Levy

Financial assistance

The FCA and financial services interfaces

The FCA and financial services interfaces: supplementary

The FCA and financial services interfaces: penalties and levies

The FCA and co-ordination with other regulators

Liability in damages

Duty to review regulations

Restrictions on processing and data protection

Regulations under this Part: supplementary

Regulations under this Part: Parliamentary procedure and consultation

Related subordinate legislation

Repeal of provisions relating to supply of customer data

Index of defined terms for this Part

Introductory

DVS trust framework

Supplementary codes

Withdrawal of a supplementary code

Review of DVS trust framework and supplementary codes

DVS register

Registration in the DVS register

Power to refuse registration in the DVS register

Registration of additional services

Supplementary notes

Addition of services to supplementary notes

Applications for registration, supplementary notes, etc

Fees for applications for registration, supplementary notes, etc

Duty to remove person from the DVS register

Power to remove person from the DVS register

Duty to remove services from the DVS register

Duty to remove supplementary notes from the DVS register

Duty to remove services from supplementary notes

Power of public authority to disclose information to registered person

Information disclosed by the Revenue and Customs

Information disclosed by the Welsh Revenue Authority

Information disclosed by Revenue Scotland

Code of practice about the disclosure of information

Trust mark for use by registered persons

Power of Secretary of State to require information

Arrangements for third party to exercise functions

Report on the operation of this Part

Index of defined terms for this Part

Powers relating to verification of identity or status

National Underground Asset Register: England and Wales

Information in relation to apparatus: England and Wales

National Underground Asset Register: Northern Ireland

Information in relation to apparatus: Northern Ireland

Pre-commencement consultation

Form in which registers of births and deaths are to be kept

Provision of equipment and facilities by local authorities

Requirements to sign register

Treatment of existing registers and records

Minor and consequential amendments

The 2018 Act and the UK GDPR

Meaning of research and statistical purposes

Consent to processing for the purposes of scientific research

Consent to law enforcement processing

Lawfulness of processing

The purpose limitation

Processing in reliance on relevant international law

Elected representatives responding to requests

Processing of special categories of personal data

Fees and reasons for responses to data subjects’ requests about law enforcement processing

Time limits for responding to data subjects’ requests

Information to be provided to data subjects

Searches in response to data subjects’ requests

Data subjects’ rights to information: legal professional privilege exemption

Automated decision-making

Data protection by design: children’s higher protection matters

Logging of law enforcement processing

General processing and codes of conduct

Law enforcement processing and codes of conduct

Transfers of personal data to third countries and international organisations

Safeguards for processing for research etc purposes

Section 86: consequential provision

National security exemption

Joint processing by intelligence services and competent authorities

Joint processing: consequential amendments

Duties of the Commissioner in carrying out functions

Codes of practice for the processing of personal data

Codes of practice: panels and impact assessments

Manifestly unfounded or excessive requests to the Commissioner

Analysis of performance

Notices from the Commissioner

Power of the Commissioner to require documents

Power of the Commissioner to require a report

Assessment notices: removal of OFSTED restriction

Interview notices

Penalty notices

Annual report on regulatory action

Complaints by data subjects

Court procedure in connection with subject access requests

Consequential amendments to the EITSET Regulations

Protection of prohibitions, restrictions and data subject’s rights

Regulations under the UK GDPR

Further minor provision about data protection

The PEC Regulations

Interpretation of the PEC Regulations

Duty to notify the Commissioner of personal data breach: time periods

Storing information in the terminal equipment of a subscriber or user

Emergency alerts: interpretation of time periods

Use of electronic mail for direct marketing by charities

Commissioner’s enforcement powers

Codes of conduct

The Information Commission

Abolition of the office of Information Commissioner

Transfer of functions to the Information Commission

Transfer of property etc to the Information Commission

Information standards for health and adult social care in England

Grant of smart meter communication licences

Disclosure of information to improve public service delivery to undertakings

Retention of information by providers of internet services in connection with death of child

Information for research about online safety matters

Retention of biometric data and recordable offences

Retention of pseudonymised biometric data

Retention of biometric data from INTERPOL

The eIDAS Regulation

Recognition of EU conformity assessment bodies

Removal of recognition of EU standards etc

Recognition of overseas trust products

Co-operation between supervisory authority and overseas authorities

Time periods: the eIDAS Regulation and the EITSET Regulations

Economic impact assessment

Report on the use of copyright works in the development of AI systems

Progress statement

Creating, or requesting the creation of, purported intimate image of adult

Power to make consequential amendments

Regulations

Extent

Commencement

Transitional, transitory and saving provision

Short title

In the New Roads and Street Works Act 1991, after Schedule 5 insert—

In the Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)), after Schedule 2 insert—

Registration Service Act 1953

Public Records Act 1958

Social Security Administration Act 1992

Education Act 1996

Adoption and Children Act 2002

Gender Recognition Act 2004

Presumption of Death Act 2013

In the UK GDPR, at the end insert—

In the UK GDPR, after Annex 1 (inserted by Schedule 4 to this Act) insert—

The UK GDPR

The 2018 Act

Introduction

Introduction

Overview and interpretation

General principles for transfer

Transfers approved by regulations

Transfers approved by regulations: monitoring

Transfers subject to appropriate safeguards

Transfers based on special circumstances

Transfers to particular recipients

Subsequent transfers

The UK GDPR

The 2018 Act

The UK GDPR: transfers approved by regulations

The UK GDPR: transfers subject to appropriate safeguards

The UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses

The UK GDPR: transfers necessary for important reasons of public interest

The UK GDPR: restrictions on transfers of personal data to third countries and international organisations

Part 3 of the 2018 Act (law enforcement processing): transfers approved by regulations

Part 3 of the 2018 Act (law enforcement processing): transfers subject to appropriate safeguards

The UK GDPR

The 2018 Act

The UK GDPR

The 2018 Act

Victims and Prisoners Act 2024

In the PEC Regulations, before Schedule 1 insert—

This is the Schedule to be substituted for Schedule 1 to the PEC Regulations—

Schedule 12A to the Data Protection Act 2018

Transitional provision: first chair

Transitional provision: consultation about non-executive members

Transitional provision: consultation about interim chief executive

Gas Act 1986

Electricity Act 1989

Electricity and Gas (Competitive Tenders for Smart Meter Communication Licences) Regulations 2012

Editorial notes