LegalizeReform history
Data (Use and Access) Act 2025
11 versions
· 2025-06-19
2026-03-31
Data (Use and Access) Act 2025
2026-02-12
Data (Use and Access) Act 2025
2026-02-06
Data (Use and Access) Act 2025
2026-02-05
Data (Use and Access) Act 2025
2025-12-01
Data (Use and Access) Act 2025
2025-11-17
Data (Use and Access) Act 2025
Changes on 2025-11-17
@@ -18,7 +18,7 @@
- “*data holder*”, in relation to customer data or business data of a trader, means— the trader, or a person who, in the course of a business, processes the data;
- “*data regulations*” means regulations under [section 2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-09-30) or [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-09-30) (and see section [23](https://www.legislation.gov.uk/ukpga/2025/18/section/23/2025-09-30));
- “*data regulations*” means regulations under [section 2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-11-17) or [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-11-17) (and see section [23](https://www.legislation.gov.uk/ukpga/2025/18/section/23/2025-11-17));
- “*trader*” means a person who supplies or provides goods, services or digital content in the course of a business, whether acting personally or through another person acting in the trader’s name or on the trader’s behalf.
@@ -30,9 +30,9 @@
- (c) otherwise received goods, services or digital content free of charge from T.
- (4) In subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/1/3/2025-09-30), the references to purchase, supply, provision or receipt of goods, services or digital content at any time include purchase, supply, provision or receipt before this section comes into force.
- (5) In subsections [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/1/3/2025-09-30) and [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/1/4/2025-09-30), references to purchasing goods, services or digital content include entering into an agreement to do so.
- (4) In subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/1/3/2025-11-17), the references to purchase, supply, provision or receipt of goods, services or digital content at any time include purchase, supply, provision or receipt before this section comes into force.
- (5) In subsections [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/1/3/2025-11-17) and [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/1/4/2025-11-17), references to purchasing goods, services or digital content include entering into an agreement to do so.
- (6) In this Part—
@@ -52,7 +52,7 @@
- (b) to a person of a specified description who is authorised by the customer to receive the data (an “authorised person”), at the customer’s request or at the authorised person’s request.
- (2) In this Part, in relation to customer data, “*third party recipient*” means a person of a description specified by provision made under subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/1/2025-09-30)[(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/1/b/2025-09-30) (and see section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/1/2025-09-30)).
- (2) In this Part, in relation to customer data, “*third party recipient*” means a person of a description specified by provision made under subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/1/2025-11-17)[(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/1/b/2025-11-17) (and see section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/1/2025-11-17)).
- (3) The Secretary of State or the Treasury may by regulations make provision enabling or requiring a data holder—
@@ -78,7 +78,7 @@
##### 3
- (1) This section is about provision that regulations under [section 2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-09-30) may (among other things) contain.
- (1) This section is about provision that regulations under [section 2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-11-17) may (among other things) contain.
- (2) The regulations may include—
@@ -86,11 +86,11 @@
- (b) provision restricting the persons that may be authorised to persons that comply with specified conditions;
- (c) provision for a specified person to decide whether a person satisfies the conditions for authorisation (and see [section 6](https://www.legislation.gov.uk/ukpga/2025/18/section/6/2025-09-30) for further provision about decision-makers).
- (c) provision for a specified person to decide whether a person satisfies the conditions for authorisation (and see [section 6](https://www.legislation.gov.uk/ukpga/2025/18/section/6/2025-11-17) for further provision about decision-makers).
- (3) The regulations may make provision about requests relating to customer data, including provision about the circumstances in which a data holder may or must refuse to act on a request.
- (4) The regulations may make provision about the providing of customer data and the taking of action described in section [2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-09-30)[(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/4/2025-09-30), including—
- (4) The regulations may make provision about the providing of customer data and the taking of action described in section [2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-11-17)[(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/4/2025-11-17), including—
- (a) provision requiring a data holder to provide customer data on one or more occasions, for a specified period or at specified intervals;
@@ -100,7 +100,7 @@
- (d) provision requiring a data holder or third party recipient to provide, or arrange for, specified assistance in connection with the establishment, maintenance or management of such facilities or services;
- (e) provision about interface bodies (see section [7](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2025-09-30)).
- (e) provision about interface bodies (see section [7](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2025-11-17)).
- (5) The regulations may include—
@@ -118,7 +118,7 @@
- (c) provision requiring a third party recipient to provide, or arrange for, specified assistance in connection with the establishment, maintenance or management of such facilities or services;
- (d) provision about interface bodies (see section [7](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2025-09-30));
- (d) provision about interface bodies (see section [7](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2025-11-17));
- (e) provision about further disclosure of the data, including provision for a person to whom customer data is further disclosed to be subject to—
@@ -146,7 +146,7 @@
- (e) provision about appeals to a court or tribunal.
- (11) In subsections [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/3/4/2025-09-30)[(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/3/4/d/2025-09-30) and [(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/3/7/2025-09-30)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/3/7/c/2025-09-30), references to assistance include actual or contingent financial assistance (such as, for example, a grant, loan, guarantee or indemnity or buying a company’s share capital).
- (11) In subsections [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/3/4/2025-11-17)[(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/3/4/d/2025-11-17) and [(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/3/7/2025-11-17)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/3/7/c/2025-11-17), references to assistance include actual or contingent financial assistance (such as, for example, a grant, loan, guarantee or indemnity or buying a company’s share capital).
#### Power to make provision in connection with business data
@@ -158,7 +158,7 @@
- (b) to another person of a specified description.
- (2) In this Part, in relation to business data, “*third party recipient*” means a person of a description specified by provision made under subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/1/2025-09-30)[(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/1/b/2025-09-30) (and see section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/1/2025-09-30)).
- (2) In this Part, in relation to business data, “*third party recipient*” means a person of a description specified by provision made under subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/1/2025-11-17)[(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/1/b/2025-11-17) (and see section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/1/2025-11-17)).
- (3) The Secretary of State or the Treasury may by regulations make provision enabling or requiring a data holder to produce, collect or retain, or arrange for the production, collection or retention of, business data.
@@ -170,11 +170,11 @@
- (ii) to another person of a specified description,
- (b) make provision requiring a person who is a third party recipient in relation to business data (whether by virtue of those regulations or other data regulations), and who is appointed by a public authority to do something with the business data, to publish or provide business data as described in paragraph [(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/a/2025-09-30)[(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/a/i/2025-09-30) or [(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/a/ii/2025-09-30),
- (c) in relation to the public authority, or the appointed person referred to in paragraph [(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/a/2025-09-30) or [(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/b/2025-09-30), make any provision that could be made in relation to a data holder, in connection with business data, in reliance on subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/3/2025-09-30) or sections [5](https://www.legislation.gov.uk/ukpga/2025/18/section/5/2025-09-30) to [21](https://www.legislation.gov.uk/ukpga/2025/18/section/21/2025-09-30), other than provision imposing a levy on the public authority or person, and
- (d) in relation to a person to whom the public authority or appointed person is required to provide business data by virtue of provision made under paragraph [(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/a/2025-09-30) or [(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/b/2025-09-30), other than a customer described in paragraph [(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/a/2025-09-30)[(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/a/i/2025-09-30), make any provision that could be made in relation to a third party recipient in reliance on sections [5](https://www.legislation.gov.uk/ukpga/2025/18/section/5/2025-09-30) to [21](https://www.legislation.gov.uk/ukpga/2025/18/section/21/2025-09-30).
- (b) make provision requiring a person who is a third party recipient in relation to business data (whether by virtue of those regulations or other data regulations), and who is appointed by a public authority to do something with the business data, to publish or provide business data as described in paragraph [(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/a/2025-11-17)[(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/a/i/2025-11-17) or [(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/a/ii/2025-11-17),
- (c) in relation to the public authority, or the appointed person referred to in paragraph [(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/a/2025-11-17) or [(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/b/2025-11-17), make any provision that could be made in relation to a data holder, in connection with business data, in reliance on subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/3/2025-11-17) or sections [5](https://www.legislation.gov.uk/ukpga/2025/18/section/5/2025-11-17) to [21](https://www.legislation.gov.uk/ukpga/2025/18/section/21/2025-11-17), other than provision imposing a levy on the public authority or person, and
- (d) in relation to a person to whom the public authority or appointed person is required to provide business data by virtue of provision made under paragraph [(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/a/2025-11-17) or [(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/b/2025-11-17), other than a customer described in paragraph [(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/a/2025-11-17)[(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/a/i/2025-11-17), make any provision that could be made in relation to a third party recipient in reliance on sections [5](https://www.legislation.gov.uk/ukpga/2025/18/section/5/2025-11-17) to [21](https://www.legislation.gov.uk/ukpga/2025/18/section/21/2025-11-17).
- (5) In deciding whether to make regulations under this section, the Secretary of State or the Treasury must have regard to (among other things)—
@@ -192,7 +192,7 @@
##### 5
- (1) This section is about provision that regulations under [section 4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-09-30) may (among other things) contain.
- (1) This section is about provision that regulations under [section 4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-11-17) may (among other things) contain.
- (2) The regulations may require business data to be provided on request and make provision about requests, including—
@@ -204,7 +204,7 @@
- (a) provision restricting the persons that may be approved to persons that comply with specified conditions;
- (b) provision for a specified person to decide whether a person satisfies the conditions for approval (and see [section 6](https://www.legislation.gov.uk/ukpga/2025/18/section/6/2025-09-30) for further provision about decision-makers).
- (b) provision for a specified person to decide whether a person satisfies the conditions for approval (and see [section 6](https://www.legislation.gov.uk/ukpga/2025/18/section/6/2025-11-17) for further provision about decision-makers).
- (4) The regulations may make provision about the providing or publishing of business data, including—
@@ -216,7 +216,7 @@
- (d) provision requiring a data holder or third party recipient to provide, or arrange for, specified assistance in connection with the establishment, maintenance or management of such facilities or services;
- (e) provision about interface bodies (see section [7](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2025-09-30)).
- (e) provision about interface bodies (see section [7](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2025-11-17)).
- (5) The regulations may include—
@@ -234,7 +234,7 @@
- (c) provision requiring a third party recipient to provide, or arrange for, specified assistance in connection with the establishment, maintenance or management of such facilities or services;
- (d) provision about interface bodies (see section [7](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2025-09-30));
- (d) provision about interface bodies (see section [7](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2025-11-17));
- (e) provision about further disclosure of the data, including provision for a person to whom business data is further disclosed to be subject to some or all of the obligations imposed on customers or third party recipients by the regulations in relation to the business data.
@@ -254,23 +254,23 @@
- (e) provision about appeals to a court or tribunal.
- (11) In subsections [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/5/4/2025-09-30)[(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/5/4/d/2025-09-30) and [(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/5/7/2025-09-30)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/5/7/c/2025-09-30), references to assistance include actual or contingent financial assistance (such as, for example, a grant, loan, guarantee or indemnity or buying a company’s share capital).
- (11) In subsections [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/5/4/2025-11-17)[(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/5/4/d/2025-11-17) and [(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/5/7/2025-11-17)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/5/7/c/2025-11-17), references to assistance include actual or contingent financial assistance (such as, for example, a grant, loan, guarantee or indemnity or buying a company’s share capital).
#### Decision-makers
##### 6
- (1) This section is about the provision about decision-makers that regulations under [section 2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-09-30) or [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-09-30) may or must (among other things) contain.
- (2) In this Part, “*decision-maker*” means a person who is authorised or required to take a decision described in section [3](https://www.legislation.gov.uk/ukpga/2025/18/section/3/2025-09-30)[(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/3/2/2025-09-30)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/3/2/c/2025-09-30) (authorisation) or [5](https://www.legislation.gov.uk/ukpga/2025/18/section/5/2025-09-30)[(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/5/3/2025-09-30)[(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/5/3/b/2025-09-30) (approval).
- (1) This section is about the provision about decision-makers that regulations under [section 2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-11-17) or [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-11-17) may or must (among other things) contain.
- (2) In this Part, “*decision-maker*” means a person who is authorised or required to take a decision described in section [3](https://www.legislation.gov.uk/ukpga/2025/18/section/3/2025-11-17)[(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/3/2/2025-11-17)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/3/2/c/2025-11-17) (authorisation) or [5](https://www.legislation.gov.uk/ukpga/2025/18/section/5/2025-11-17)[(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/5/3/2025-11-17)[(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/5/3/b/2025-11-17) (approval).
- (3) The regulations may make provision about the appointment of a decision-maker.
- (4) The regulations may make provision enabling or requiring a decision-maker to suspend or revoke a decision.
- (5) The regulations may confer powers on a decision-maker for the purpose of monitoring compliance with conditions for authorisation or approval (“monitoring powers”) (and see [section 8](https://www.legislation.gov.uk/ukpga/2025/18/section/8/2025-09-30) for provision about enforcement of requirements imposed in exercise of those powers).
- (6) The monitoring powers that may be conferred on a decision-maker include powers to require the provision of documents or information (but such powers are subject to the restrictions in [section 9](https://www.legislation.gov.uk/ukpga/2025/18/section/9/2025-09-30) as well as any restrictions included in the regulations).
- (5) The regulations may confer powers on a decision-maker for the purpose of monitoring compliance with conditions for authorisation or approval (“monitoring powers”) (and see [section 8](https://www.legislation.gov.uk/ukpga/2025/18/section/8/2025-11-17) for provision about enforcement of requirements imposed in exercise of those powers).
- (6) The monitoring powers that may be conferred on a decision-maker include powers to require the provision of documents or information (but such powers are subject to the restrictions in [section 9](https://www.legislation.gov.uk/ukpga/2025/18/section/9/2025-11-17) as well as any restrictions included in the regulations).
- (7) The regulations must make provision about the rights of persons affected by the exercise of a decision-maker’s functions under the regulations and such provision may include (among other things)—
@@ -308,9 +308,9 @@
##### 7
- (1) This section is about the provision that regulations under section [2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-09-30) or [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-09-30) may (among other things) contain about bodies with one or more of the following tasks—
- (a) establishing a facility or service used, or capable of being used, for providing, publishing or otherwise processing customer data or business data or for taking action described in section [2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-09-30)[(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/4/2025-09-30) (referred to in this Part as an “*interface*”);
- (1) This section is about the provision that regulations under section [2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-11-17) or [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-11-17) may (among other things) contain about bodies with one or more of the following tasks—
- (a) establishing a facility or service used, or capable of being used, for providing, publishing or otherwise processing customer data or business data or for taking action described in section [2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-11-17)[(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/4/2025-11-17) (referred to in this Part as an “*interface*”);
- (b) setting standards, or making other arrangements, relating to, or to the use of, an interface (referred to in this Part as “*interface standards*” and “interface arrangements”);
@@ -324,7 +324,7 @@
- (b) make provision about the type of body to be set up.
- (4) In relation to an interface body (whether or not it is required to be set up by regulations under section [2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-09-30) or [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-09-30)), the regulations may—
- (4) In relation to an interface body (whether or not it is required to be set up by regulations under section [2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-11-17) or [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-11-17)), the regulations may—
- (a) make provision about the body’s composition and governance;
@@ -332,13 +332,13 @@
- (c) impose other requirements relating to the body on a person who is required to set it up or to provide, or arrange for, assistance for the body;
- (d) make provision requiring the body to carry on all or part of a task described in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/7/1/2025-09-30);
- (d) make provision requiring the body to carry on all or part of a task described in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/7/1/2025-11-17);
- (e) make provision requiring the body to do other things in connection with its interface, interface standards or interface arrangements;
- (f) make provision about how the body carries out its functions (such as, for example, provision about the body’s objectives or matters to be taken into account by the body);
- (g) confer powers on the body for the purpose of monitoring use of its interface, interface standards or interface arrangements (“monitoring powers”) (and see section [8](https://www.legislation.gov.uk/ukpga/2025/18/section/8/2025-09-30) for provision about enforcement of requirements imposed in exercise of those powers);
- (g) confer powers on the body for the purpose of monitoring use of its interface, interface standards or interface arrangements (“monitoring powers”) (and see section [8](https://www.legislation.gov.uk/ukpga/2025/18/section/8/2025-11-17) for provision about enforcement of requirements imposed in exercise of those powers);
- (h) make provision for the body to arrange for its monitoring powers to be exercised by another person;
@@ -354,11 +354,11 @@
- (l) make provision enabling or requiring the body to produce guidance about how it proposes to exercise its functions under the regulations, to publish the guidance and to provide copies to specified persons.
- (5) The monitoring powers that may be conferred on an interface body include power to require the provision of documents or information (but such powers are subject to the restrictions in section [9](https://www.legislation.gov.uk/ukpga/2025/18/section/9/2025-09-30) as well as any restrictions included in the regulations).
- (6) Examples of facilities or services referred to in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/7/1/2025-09-30) include dashboard services, other electronic communications services and application programming interfaces.
- (7) In subsection [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/7/4/2025-09-30)[(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/7/4/b/2025-09-30) and [(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/7/4/c/2025-09-30), the references to assistance include actual or contingent financial assistance (such as, for example, a grant, loan, guarantee or indemnity or buying a company’s share capital).
- (5) The monitoring powers that may be conferred on an interface body include power to require the provision of documents or information (but such powers are subject to the restrictions in section [9](https://www.legislation.gov.uk/ukpga/2025/18/section/9/2025-11-17) as well as any restrictions included in the regulations).
- (6) Examples of facilities or services referred to in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/7/1/2025-11-17) include dashboard services, other electronic communications services and application programming interfaces.
- (7) In subsection [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/7/4/2025-11-17)[(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/7/4/b/2025-11-17) and [(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/7/4/c/2025-11-17), the references to assistance include actual or contingent financial assistance (such as, for example, a grant, loan, guarantee or indemnity or buying a company’s share capital).
### Enforcement
@@ -374,9 +374,9 @@
including provision for monitoring or enforcement by a specified public authority.
- (2) In this Part, “*enforcer*” means a public authority that is authorised or required to carry out monitoring or enforcement described in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/8/1/2025-09-30).
- (3) The following subsections make provision about what regulations under [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/8/1/2025-09-30) may or must (among other things) contain (and see sections [9](https://www.legislation.gov.uk/ukpga/2025/18/section/9/2025-09-30) and [10](https://www.legislation.gov.uk/ukpga/2025/18/section/10/2025-09-30)).
- (2) In this Part, “*enforcer*” means a public authority that is authorised or required to carry out monitoring or enforcement described in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/8/1/2025-11-17).
- (3) The following subsections make provision about what regulations under [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/8/1/2025-11-17) may or must (among other things) contain (and see sections [9](https://www.legislation.gov.uk/ukpga/2025/18/section/9/2025-11-17) and [10](https://www.legislation.gov.uk/ukpga/2025/18/section/10/2025-11-17)).
- (4) The regulations may confer powers of investigation on an enforcer, including—
@@ -386,7 +386,7 @@
- (c) powers of entry, inspection, search and seizure,
but such powers are subject to the restrictions in [section 9](https://www.legislation.gov.uk/ukpga/2025/18/section/9/2025-09-30) (as well as any restrictions included in the regulations).
but such powers are subject to the restrictions in [section 9](https://www.legislation.gov.uk/ukpga/2025/18/section/9/2025-11-17) (as well as any restrictions included in the regulations).
- (5) The regulations may—
@@ -394,7 +394,7 @@
- (i) regulations under this Part;
- (ii) a condition for authorisation or approval (referred to in sections [3](https://www.legislation.gov.uk/ukpga/2025/18/section/3/2025-09-30)[(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/3/2/2025-09-30) and [5](https://www.legislation.gov.uk/ukpga/2025/18/section/5/2025-09-30)[(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/5/3/2025-09-30));
- (ii) a condition for authorisation or approval (referred to in sections [3](https://www.legislation.gov.uk/ukpga/2025/18/section/3/2025-11-17)[(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/3/2/2025-11-17) and [5](https://www.legislation.gov.uk/ukpga/2025/18/section/5/2025-11-17)[(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/5/3/2025-11-17));
- (iii) any other requirement imposed in exercise of a power conferred by regulations under this Part;
@@ -424,7 +424,7 @@
- (d) a failure to comply with any other requirement imposed in exercise of a power conferred by regulations under this Part;
and see [section 10](https://www.legislation.gov.uk/ukpga/2025/18/section/10/2025-09-30) for further provision about financial penalties.
and see [section 10](https://www.legislation.gov.uk/ukpga/2025/18/section/10/2025-11-17) for further provision about financial penalties.
- (8) The regulations may make provision about the rights of persons affected by the exercise of an enforcer’s functions under the regulations, including—
@@ -434,7 +434,7 @@
- (9) The regulations may make provision about complaints, including provision requiring an enforcer to implement procedures for the handling of complaints.
- (10) The regulations may make provision enabling or requiring an enforcer to publish, or to provide to a specified person, specified documents or information relating to monitoring or enforcement described in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/8/1/2025-09-30), including—
- (10) The regulations may make provision enabling or requiring an enforcer to publish, or to provide to a specified person, specified documents or information relating to monitoring or enforcement described in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/8/1/2025-11-17), including—
- (a) documents or information relating to the exercise of the enforcer’s functions, and
@@ -470,7 +470,7 @@
- (a) authorise entry to a private dwelling without a warrant issued by a justice, or
- (b) require a person to provide information within subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/9/2/2025-09-30) to [(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/9/7/2025-09-30)to a decision-maker, an interface body or an enforcer.
- (b) require a person to provide information within subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/9/2/2025-11-17) to [(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/9/7/2025-11-17)to a decision-maker, an interface body or an enforcer.
- (2) Information is within this subsection if requiring a person to provide the information would involve an infringement of the privileges of either House of Parliament.
@@ -488,11 +488,11 @@
- (c) for the purposes of such proceedings.
- (5) In subsections [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/9/3/2025-09-30) and [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/9/4/2025-09-30), references to the client of a professional legal adviser include references to a person acting on behalf of the client.
- (5) In subsections [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/9/3/2025-11-17) and [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/9/4/2025-11-17), references to the client of a professional legal adviser include references to a person acting on behalf of the client.
- (6) Information is within this subsection if requiring a person to provide the information would, by revealing evidence of the commission of an offence, expose the person to proceedings for that offence.
- (7) The reference to an offence in [subsection (6)](https://www.legislation.gov.uk/ukpga/2025/18/section/9/6/2025-09-30) does not include an offence under—
- (7) The reference to an offence in [subsection (6)](https://www.legislation.gov.uk/ukpga/2025/18/section/9/6/2025-11-17) does not include an offence under—
- (a) regulations made under this Part;
@@ -528,7 +528,7 @@
- (b) an amount not exceeding such an amount,
unless section [16](https://www.legislation.gov.uk/ukpga/2025/18/section/16/2025-09-30) confers power to provide otherwise.
unless section [16](https://www.legislation.gov.uk/ukpga/2025/18/section/16/2025-11-17) confers power to provide otherwise.
- (3) The regulations must include provision—
@@ -550,7 +550,7 @@
- (4) The regulations may include provision—
- (a) requiring or enabling an enforcer to provide copies of guidance described in subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/10/3/2025-09-30)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/10/3/a/2025-09-30) to specified persons;
- (a) requiring or enabling an enforcer to provide copies of guidance described in subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/10/3/2025-11-17)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/10/3/a/2025-11-17) to specified persons;
- (b) enabling a notice of intent or final notice to be withdrawn or amended;
@@ -574,7 +574,7 @@
- (1) The Secretary of State or the Treasury may by regulations—
- (a) make provision enabling a person listed in subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/2/2025-09-30), or a person acting on their behalf, to require other persons to pay fees in connection with activities described in subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/3/2025-09-30), and
- (a) make provision enabling a person listed in subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/2/2025-11-17), or a person acting on their behalf, to require other persons to pay fees in connection with activities described in subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/3/2025-11-17), and
- (b) make provision about what must or may be done with amounts paid as fees.
@@ -590,47 +590,47 @@
- (e) other persons on whom duties are imposed, or powers are conferred, by or under regulations made under this Part.
- (3) Those activities are performing duties, or exercising powers, imposed or conferred on the person listed in subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/2/2025-09-30) by or under regulations made under this Part.
- (4) Regulations under [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/1/2025-09-30)—
- (3) Those activities are performing duties, or exercising powers, imposed or conferred on the person listed in subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/2/2025-11-17) by or under regulations made under this Part.
- (4) Regulations under [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/1/2025-11-17)—
- (a) may only provide for a fee to be payable by persons that appear to the Secretary of State or the Treasury to be capable of being directly affected by the performance of duties, or the exercise of powers, imposed or conferred by or under regulations made under this Part;
- (b) may provide for the amount of a fee to be an amount which is intended to exceed the cost of the things in connection with which the fee is charged (and for the total amount of fees payable in connection with things to exceed the total cost).
- (5) Regulations under [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/1/2025-09-30) must provide for the amount of a fee to be—
- (5) Regulations under [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/1/2025-11-17) must provide for the amount of a fee to be—
- (a) a specified amount or an amount determined in accordance with the regulations, or
- (b) an amount not exceeding such an amount,
unless section [15](https://www.legislation.gov.uk/ukpga/2025/18/section/15/2025-09-30) confers power to provide otherwise.
- (6) Regulations under subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/1/2025-09-30) may provide for the amount, or maximum amount, of a fee to increase at specified times and by—
unless section [15](https://www.legislation.gov.uk/ukpga/2025/18/section/15/2025-11-17) confers power to provide otherwise.
- (6) Regulations under subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/1/2025-11-17) may provide for the amount, or maximum amount, of a fee to increase at specified times and by—
- (a) a specified amount or an amount determined in accordance with the regulations, or
- (b) an amount not exceeding such an amount.
- (7) Regulations under [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/1/2025-09-30) enabling a person to determine the amount of a fee must require the person to publish information about the amount and how it is determined.
- (8) Regulations under [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/1/2025-09-30) may (among other things) make provision about—
- (7) Regulations under [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/1/2025-11-17) enabling a person to determine the amount of a fee must require the person to publish information about the amount and how it is determined.
- (8) Regulations under [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/1/2025-11-17) may (among other things) make provision about—
- (a) interest on any unpaid amounts;
- (b) the recovery of unpaid amounts.
- (9) The Secretary of State or the Treasury may by regulations make provision about whether a person listed in subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/2/2025-09-30), or a person acting on their behalf, who could require payment in connection with an activity described in subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/3/2025-09-30) otherwise than in reliance on regulations under subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/1/2025-09-30) may do so.
- (9) The Secretary of State or the Treasury may by regulations make provision about whether a person listed in subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/2/2025-11-17), or a person acting on their behalf, who could require payment in connection with an activity described in subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/3/2025-11-17) otherwise than in reliance on regulations under subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/1/2025-11-17) may do so.
- (10) Where duties or powers are imposed or conferred—
- (a) on a person in their capacity as a third party recipient by or under regulations made under this Part, other than regulations made in reliance on section [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-09-30)[(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/2025-09-30)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/a/2025-09-30), [(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/b/2025-09-30) or [(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/c/2025-09-30), or
- (b) on a person in their capacity as a person described in section [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-09-30)[(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/2025-09-30)[(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/d/2025-09-30) by or under regulations made under this Part,
nothing in this section, or in regulations under subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/1/2025-09-30) or [(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/9/2025-09-30), prevents the person, or a person acting on their behalf, from requiring payment in connection with the performance or exercise of those duties or powers, or restricts their ability to do so, where the person could do so otherwise than in reliance on regulations under subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/1/2025-09-30).
- (11) Examples of requiring payment otherwise than in reliance on regulations under subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/1/2025-09-30) include doing so in reliance on other legislation or a contract or other arrangement (whenever entered into).
- (a) on a person in their capacity as a third party recipient by or under regulations made under this Part, other than regulations made in reliance on section [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-11-17)[(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/2025-11-17)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/a/2025-11-17), [(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/b/2025-11-17) or [(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/c/2025-11-17), or
- (b) on a person in their capacity as a person described in section [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-11-17)[(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/2025-11-17)[(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/d/2025-11-17) by or under regulations made under this Part,
nothing in this section, or in regulations under subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/1/2025-11-17) or [(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/9/2025-11-17), prevents the person, or a person acting on their behalf, from requiring payment in connection with the performance or exercise of those duties or powers, or restricts their ability to do so, where the person could do so otherwise than in reliance on regulations under subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/1/2025-11-17).
- (11) Examples of requiring payment otherwise than in reliance on regulations under subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/1/2025-11-17) include doing so in reliance on other legislation or a contract or other arrangement (whenever entered into).
#### Levy
@@ -638,11 +638,11 @@
- (1) The Secretary of State or the Treasury may by regulations—
- (a) impose, or provide for a specified public authority to impose, a levy on data holders or third party recipients for the purpose of meeting expenses described in subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/12/2/2025-09-30), and
- (a) impose, or provide for a specified public authority to impose, a levy on data holders or third party recipients for the purpose of meeting expenses described in subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/12/2/2025-11-17), and
- (b) make provision about what must or may be done with funds raised by means of the levy.
- (2) Those expenses are expenses incurred, or to be incurred, during a period by a person listed in subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/12/3/2025-09-30), or a person acting on their behalf, in performing duties, or exercising powers, imposed or conferred on the person listed in subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/12/3/2025-09-30) by or under regulations made under this Part.
- (2) Those expenses are expenses incurred, or to be incurred, during a period by a person listed in subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/12/3/2025-11-17), or a person acting on their behalf, in performing duties, or exercising powers, imposed or conferred on the person listed in subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/12/3/2025-11-17) by or under regulations made under this Part.
- (3) Those persons are—
@@ -652,11 +652,11 @@
- (c) enforcers;
- (d) public authorities subject to requirements imposed by regulations made in reliance on section [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-09-30)[(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/2025-09-30).
- (4) Regulations under [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/12/1/2025-09-30) may only provide for a levy in respect of expenses of a person to be imposed on data holders or third party recipients that appear to the Secretary of State or the Treasury to be capable of being directly affected by the exercise of some or all of the functions conferred on the person by or under regulations made under this Part.
- (5) Regulations under [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/12/1/2025-09-30) providing for a specified public authority to impose a levy must—
- (d) public authorities subject to requirements imposed by regulations made in reliance on section [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-11-17)[(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/2025-11-17).
- (4) Regulations under [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/12/1/2025-11-17) may only provide for a levy in respect of expenses of a person to be imposed on data holders or third party recipients that appear to the Secretary of State or the Treasury to be capable of being directly affected by the exercise of some or all of the functions conferred on the person by or under regulations made under this Part.
- (5) Regulations under [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/12/1/2025-11-17) providing for a specified public authority to impose a levy must—
- (a) make provision about how the rate of the levy is to be determined;
@@ -664,7 +664,7 @@
- (c) require the public authority to publish information about the rate, the period and how they are determined.
- (6) Regulations under [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/12/1/2025-09-30) may (among other things) make provision about—
- (6) Regulations under [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/12/1/2025-11-17) may (among other things) make provision about—
- (a) interest on any unpaid amounts payable by way of a levy;
@@ -680,7 +680,7 @@
- (b) exercising other functions in connection with such regulations.
- (2) But subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/13/1/2025-09-30) does not enable financial assistance to be provided to a person listed in subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/13/3/2025-09-30) or to a person acting on their behalf.
- (2) But subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/13/1/2025-11-17) does not enable financial assistance to be provided to a person listed in subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/13/3/2025-11-17) or to a person acting on their behalf.
- (3) Those persons are—
@@ -688,7 +688,7 @@
- (b) customers, or
- (c) third party recipients, other than a third party recipient that is a public authority subject to requirements imposed by regulations made in reliance on section [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-09-30)[(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/2025-09-30).
- (c) third party recipients, other than a third party recipient that is a public authority subject to requirements imposed by regulations made in reliance on section [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-11-17)[(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/2025-11-17).
- (4) The financial assistance may be given on such terms and conditions as the Secretary of State or the Treasury considers appropriate.
@@ -706,9 +706,9 @@
- (b) requiring persons described in the regulations to use a prescribed interface, comply with prescribed interface standards or participate in prescribed interface arrangements, when the person, in the course of a business, receives, from a financial services provider, customer data or business data which is required to be provided to the person by data regulations;
- (c) requiring section [2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-09-30)[(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/4/2025-09-30) actors described in the regulations to use a prescribed interface, comply with prescribed interface standards or participate in prescribed interface arrangements when taking, facilitating or doing other things in connection with relevant financial services action;
- (d) imposing interface-related requirements on a description of person falling within subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/14/3/2025-09-30).
- (c) requiring section [2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-11-17)[(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/4/2025-11-17) actors described in the regulations to use a prescribed interface, comply with prescribed interface standards or participate in prescribed interface arrangements when taking, facilitating or doing other things in connection with relevant financial services action;
- (d) imposing interface-related requirements on a description of person falling within subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/14/3/2025-11-17).
- (2) Such rules are referred to in this Part as “*FCA interface rules*”.
@@ -716,9 +716,9 @@
- (a) an interface body linked to the financial services sector;
- (b) a person required by regulations made in reliance on section [7](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2025-09-30) to set up an interface body linked to the financial services sector;
- (c) a person who uses an interface, complies with interface standards or participates in interface arrangements linked to the financial services sector or who is required to do so by data regulations or rules made by virtue of regulations under subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/14/1/2025-09-30)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/14/1/a/2025-09-30), [(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/14/1/b/2025-09-30) or [(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/14/1/c/2025-09-30).
- (b) a person required by regulations made in reliance on section [7](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2025-11-17) to set up an interface body linked to the financial services sector;
- (c) a person who uses an interface, complies with interface standards or participates in interface arrangements linked to the financial services sector or who is required to do so by data regulations or rules made by virtue of regulations under subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/14/1/2025-11-17)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/14/1/a/2025-11-17), [(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/14/1/b/2025-11-17) or [(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/14/1/c/2025-11-17).
- (4) For the purposes of this section, requirements are interface-related if they relate to—
@@ -738,17 +738,17 @@
- (a) in response to a failure, or likely failure, by the person to comply with an FCA interface rule or FCA additional requirement, or
- (b) in order to advance a purpose which the FCA is required to advance when exercising functions conferred by regulations under this section (see section [15](https://www.legislation.gov.uk/ukpga/2025/18/section/15/2025-09-30)[(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/15/3/2025-09-30)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/15/3/a/2025-09-30)).
- (7) Regulations under subsection [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/14/6/2025-09-30) may, for example, provide for the FCA to impose requirements by giving a notice or direction.
- (8) The restrictions in section [9](https://www.legislation.gov.uk/ukpga/2025/18/section/9/2025-09-30) apply in connection with FCA interface rules and FCA additional requirements as they apply in connection with regulations under this Part.
- (9) In section [9](https://www.legislation.gov.uk/ukpga/2025/18/section/9/2025-09-30) as so applied—
- (a) the references in subsections [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/9/1/2025-09-30)[(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/9/1/b/2025-09-30) and [(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/9/8/2025-09-30) to an enforcer include the FCA, and
- (b) the references in subsections [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/9/3/2025-09-30) and [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/9/4/2025-09-30) to regulations made under this Part include FCA interface rules and FCA additional requirements.
- (b) in order to advance a purpose which the FCA is required to advance when exercising functions conferred by regulations under this section (see section [15](https://www.legislation.gov.uk/ukpga/2025/18/section/15/2025-11-17)[(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/15/3/2025-11-17)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/15/3/a/2025-11-17)).
- (7) Regulations under subsection [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/14/6/2025-11-17) may, for example, provide for the FCA to impose requirements by giving a notice or direction.
- (8) The restrictions in section [9](https://www.legislation.gov.uk/ukpga/2025/18/section/9/2025-11-17) apply in connection with FCA interface rules and FCA additional requirements as they apply in connection with regulations under this Part.
- (9) In section [9](https://www.legislation.gov.uk/ukpga/2025/18/section/9/2025-11-17) as so applied—
- (a) the references in subsections [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/9/1/2025-11-17)[(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/9/1/b/2025-11-17) and [(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/9/8/2025-11-17) to an enforcer include the FCA, and
- (b) the references in subsections [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/9/3/2025-11-17) and [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/9/4/2025-11-17) to regulations made under this Part include FCA interface rules and FCA additional requirements.
- (10) In this section—
@@ -756,19 +756,19 @@
- “*prescribed*” means prescribed in FCA interface rules;
- “*relevant financial services action*” means action described in section [2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-09-30)[(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/4/2025-09-30) taken in relation to services or digital content provided or supplied by a financial services provider;
- “*section 2(4) actor*” means— a person who, in reliance on regulations under subsection [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/4/2025-09-30) of section [2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-09-30), takes action described in that subsection; a data holder or other person who facilitates or does other things in connection with such action.
- “*relevant financial services action*” means action described in section [2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-11-17)[(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/4/2025-11-17) taken in relation to services or digital content provided or supplied by a financial services provider;
- “*section 2(4) actor*” means— a person who, in reliance on regulations under subsection [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/4/2025-11-17) of section [2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-11-17), takes action described in that subsection; a data holder or other person who facilitates or does other things in connection with such action.
#### The FCA and financial services interfaces: supplementary
##### 15
- (1) This section is about provision that regulations under section [14](https://www.legislation.gov.uk/ukpga/2025/18/section/14/2025-09-30) may or must (among other things) contain.
- (1) This section is about provision that regulations under section [14](https://www.legislation.gov.uk/ukpga/2025/18/section/14/2025-11-17) may or must (among other things) contain.
- (2) The regulations—
- (a) may require or enable the FCA to impose interface-related requirements that could be imposed by regulations made in reliance on section [7](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2025-09-30)[(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/7/4/2025-09-30) or [(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/7/5/2025-09-30), but
- (a) may require or enable the FCA to impose interface-related requirements that could be imposed by regulations made in reliance on section [7](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2025-11-17)[(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/7/4/2025-11-17) or [(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/7/5/2025-11-17), but
- (b) may not require or enable the FCA to require a person to set up an interface body.
@@ -802,21 +802,21 @@
- (c) a requirement to make redress for loss or damage suffered by others as a result of the person’s conduct.
- (6) The regulations may require or enable FCA interface rules to require a person listed in subsection [(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/15/7/2025-09-30) to pay fees to an interface body or another person listed in that subsection, or to a person acting on behalf of such a body or person, in connection with activities described in subsection [(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/15/8/2025-09-30).
- (6) The regulations may require or enable FCA interface rules to require a person listed in subsection [(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/15/7/2025-11-17) to pay fees to an interface body or another person listed in that subsection, or to a person acting on behalf of such a body or person, in connection with activities described in subsection [(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/15/8/2025-11-17).
- (7) Those persons are—
- (a) persons falling within section [14](https://www.legislation.gov.uk/ukpga/2025/18/section/14/2025-09-30)[(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/14/3/2025-09-30)[(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/14/3/b/2025-09-30) or [(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/14/3/c/2025-09-30);
- (a) persons falling within section [14](https://www.legislation.gov.uk/ukpga/2025/18/section/14/2025-11-17)[(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/14/3/2025-11-17)[(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/14/3/b/2025-11-17) or [(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/14/3/c/2025-11-17);
- (b) financial services providers.
- (8) Those activities are performing or exercising—
- (a) duties or powers imposed or conferred on the interface body or person listed in subsection [(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/15/7/2025-09-30) by FCA interface rules, and
- (a) duties or powers imposed or conferred on the interface body or person listed in subsection [(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/15/7/2025-11-17) by FCA interface rules, and
- (b) other duties or powers imposed or conferred on that body or person by or under regulations made under this Part.
- (9) Regulations made in reliance on subsection [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/15/6/2025-09-30)—
- (9) Regulations made in reliance on subsection [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/15/6/2025-11-17)—
- (a) may enable rules to provide for the amount of a fee to be an amount which is intended to exceed the cost of the things in connection with which the fee is charged (and for the total amount of fees payable in connection with things to exceed the total cost);
@@ -834,15 +834,15 @@
- (ii) the recovery of unpaid amounts.
- (10) Regulations under section [14](https://www.legislation.gov.uk/ukpga/2025/18/section/14/2025-09-30) may enable FCA interface rules to make provision about whether an interface body or a person listed in subsection [(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/15/7/2025-09-30), or a person acting on behalf of such a body or person, who could require payment in connection with an activity described in subsection [(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/15/8/2025-09-30) otherwise than in reliance on FCA interface rules may do so.
- (10) Regulations under section [14](https://www.legislation.gov.uk/ukpga/2025/18/section/14/2025-11-17) may enable FCA interface rules to make provision about whether an interface body or a person listed in subsection [(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/15/7/2025-11-17), or a person acting on behalf of such a body or person, who could require payment in connection with an activity described in subsection [(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/15/8/2025-11-17) otherwise than in reliance on FCA interface rules may do so.
- (11) Examples of requiring payment otherwise than in reliance on FCA interface rules include doing so in reliance on other legislation or a contract or other arrangement (whenever entered into).
- (12) Regulations under section [14](https://www.legislation.gov.uk/ukpga/2025/18/section/14/2025-09-30) may provide that powers to make FCA interface rules include powers to do things described in section [21](https://www.legislation.gov.uk/ukpga/2025/18/section/21/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/21/1/2025-09-30)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/21/1/a/2025-09-30) to [(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/21/1/h/2025-09-30) (supplementary powers) (ignoring the restriction in relation to fees in section [21](https://www.legislation.gov.uk/ukpga/2025/18/section/21/2025-09-30)[(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/21/3/2025-09-30)).
- (13) In this section, “financial services provider” and “*interface-related*” have the meaning given in section [14](https://www.legislation.gov.uk/ukpga/2025/18/section/14/2025-09-30).
- (14) The reference in subsection [(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/15/5/2025-09-30)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/15/5/c/2025-09-30) to making redress includes—
- (12) Regulations under section [14](https://www.legislation.gov.uk/ukpga/2025/18/section/14/2025-11-17) may provide that powers to make FCA interface rules include powers to do things described in section [21](https://www.legislation.gov.uk/ukpga/2025/18/section/21/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/21/1/2025-11-17)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/21/1/a/2025-11-17) to [(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/21/1/h/2025-11-17) (supplementary powers) (ignoring the restriction in relation to fees in section [21](https://www.legislation.gov.uk/ukpga/2025/18/section/21/2025-11-17)[(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/21/3/2025-11-17)).
- (13) In this section, “financial services provider” and “*interface-related*” have the meaning given in section [14](https://www.legislation.gov.uk/ukpga/2025/18/section/14/2025-11-17).
- (14) The reference in subsection [(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/15/5/2025-11-17)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/15/5/c/2025-11-17) to making redress includes—
- (a) paying interest, and
@@ -852,15 +852,15 @@
##### 16
- (1) Subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/16/2/2025-09-30) and [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/16/3/2025-09-30) are about the provision that regulations made by the Treasury under this Part providing for the FCA to enforce requirements under FCA interface rules may (among other things) contain in relation to financial penalties.
- (1) Subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/16/2/2025-11-17) and [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/16/3/2025-11-17) are about the provision that regulations made by the Treasury under this Part providing for the FCA to enforce requirements under FCA interface rules may (among other things) contain in relation to financial penalties.
- (2) The regulations may require or enable the FCA—
- (a) to set the amount or maximum amount of, or of an increase in, a penalty imposed in respect of failure to comply with a requirement imposed by the FCA in exercise of a power conferred by regulations under section [14](https://www.legislation.gov.uk/ukpga/2025/18/section/14/2025-09-30) (whether imposed by means of FCA interface rules or an FCA additional requirement), or
- (a) to set the amount or maximum amount of, or of an increase in, a penalty imposed in respect of failure to comply with a requirement imposed by the FCA in exercise of a power conferred by regulations under section [14](https://www.legislation.gov.uk/ukpga/2025/18/section/14/2025-11-17) (whether imposed by means of FCA interface rules or an FCA additional requirement), or
- (b) to set the method for determining such an amount.
- (3) Regulations made in reliance on subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/16/2/2025-09-30)—
- (3) Regulations made in reliance on subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/16/2/2025-11-17)—
- (a) must require the FCA to produce and publish a statement of its policy with respect to the amount of the penalties;
@@ -874,13 +874,13 @@
- (4) The Treasury may by regulations—
- (a) impose, or provide for the FCA to impose, a levy on data holders or third party recipients for the purpose of meeting expenses incurred, or to be incurred, during a period by the FCA, or by a person acting on the FCA’s behalf, in performing duties, or exercising powers, imposed or conferred on the FCA by regulations under section [14](https://www.legislation.gov.uk/ukpga/2025/18/section/14/2025-09-30), and
- (a) impose, or provide for the FCA to impose, a levy on data holders or third party recipients for the purpose of meeting expenses incurred, or to be incurred, during a period by the FCA, or by a person acting on the FCA’s behalf, in performing duties, or exercising powers, imposed or conferred on the FCA by regulations under section [14](https://www.legislation.gov.uk/ukpga/2025/18/section/14/2025-11-17), and
- (b) make provision about what must or may be done with funds raised by means of the levy.
- (5) Regulations under subsection [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/16/4/2025-09-30) may only provide for a levy in respect of expenses of the FCA to be imposed on persons that appear to the Treasury to be capable of being directly affected by the exercise of some or all of the functions conferred on the FCA by regulations under section [14](https://www.legislation.gov.uk/ukpga/2025/18/section/14/2025-09-30).
- (6) Regulations under subsection [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/16/4/2025-09-30) providing for the FCA to impose a levy must—
- (5) Regulations under subsection [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/16/4/2025-11-17) may only provide for a levy in respect of expenses of the FCA to be imposed on persons that appear to the Treasury to be capable of being directly affected by the exercise of some or all of the functions conferred on the FCA by regulations under section [14](https://www.legislation.gov.uk/ukpga/2025/18/section/14/2025-11-17).
- (6) Regulations under subsection [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/16/4/2025-11-17) providing for the FCA to impose a levy must—
- (a) make provision about how the rate of the levy is to be determined;
@@ -888,7 +888,7 @@
- (c) require the FCA to publish information about the rate, the period and how they are determined.
- (7) Regulations under subsection [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/16/4/2025-09-30) may (among other things) make provision about—
- (7) Regulations under subsection [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/16/4/2025-11-17) may (among other things) make provision about—
- (a) interest on any unpaid amounts payable by way of a levy;
@@ -910,7 +910,7 @@
##### 18
- (1) The Secretary of State or the Treasury may by regulations provide that a person listed in subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/18/2/2025-09-30) is not liable in damages for anything done or omitted to be done in the exercise of functions conferred by or under regulations made under this Part.
- (1) The Secretary of State or the Treasury may by regulations provide that a person listed in subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/18/2/2025-11-17) is not liable in damages for anything done or omitted to be done in the exercise of functions conferred by or under regulations made under this Part.
- (2) Those persons are—
@@ -930,7 +930,7 @@
##### 19
- (1) The relevant person must, by regulations, provide for the review of provision made by the relevant person in exercise of powers to make regulations under other sections in this Part (“Part 1 provision”) (but see the exceptions in subsection [(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/19/8/2025-09-30)).
- (1) The relevant person must, by regulations, provide for the review of provision made by the relevant person in exercise of powers to make regulations under other sections in this Part (“Part 1 provision”) (but see the exceptions in subsection [(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/19/8/2025-11-17)).
- (2) In this section, “*the relevant person*” means—
@@ -938,7 +938,7 @@
- (b) in relation to Part 1 provision made by the Treasury, the Treasury.
- (3) Regulations under subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/19/1/2025-09-30) must require the relevant person—
- (3) Regulations under subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/19/1/2025-11-17) must require the relevant person—
- (a) to review the Part 1 provision,
@@ -956,17 +956,17 @@
- (a) the objectives it is intended to achieve, and
- (b) to the extent that it is part of data regulations, the matters to which the relevant person was required to have regard in deciding whether to make the provision (see sections [2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-09-30)[(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/5/2025-09-30) and [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-09-30)[(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/5/2025-09-30)).
- (b) to the extent that it is part of data regulations, the matters to which the relevant person was required to have regard in deciding whether to make the provision (see sections [2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-11-17)[(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/5/2025-11-17) and [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-11-17)[(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/5/2025-11-17)).
- (6) The regulations must provide that the relevant person may omit material from a report before publication if the relevant person thinks that the publication of that material might harm the commercial interests of any person.
- (7) The regulations may (whether made by the Secretary of State or the Treasury) provide for the Secretary of State and the Treasury to carry out a joint review, and to produce a joint report, in respect of Part 1 provision made by the Secretary of State and Part 1 provision made by the Treasury.
- (8) Subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/19/1/2025-09-30) does not apply in relation to—
- (8) Subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/19/1/2025-11-17) does not apply in relation to—
- (a) Part 1 provision that is required to be reviewed by the relevant person by virtue of existing regulations under this section, or
- (b) Part 1 provision that makes, amends or revokes provision described in paragraph [(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/19/8/a/2025-09-30),
- (b) Part 1 provision that makes, amends or revokes provision described in paragraph [(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/19/8/a/2025-11-17),
nor does it require the relevant person to provide for the review of Part 1 provision that has been revoked.
@@ -976,7 +976,7 @@
##### 20
- (1) Except as provided by [subsection (2)](https://www.legislation.gov.uk/ukpga/2025/18/section/20/2/2025-09-30), regulations under this Part may provide for the processing of information in accordance with the regulations not to be in breach of—
- (1) Except as provided by [subsection (2)](https://www.legislation.gov.uk/ukpga/2025/18/section/20/2/2025-11-17), regulations under this Part may provide for the processing of information in accordance with the regulations not to be in breach of—
- (a) any obligation of confidence owed by the person processing the information, or
@@ -1014,11 +1014,11 @@
- (2) Regulations under this Part may not require or enable a person to set the maximum amount of a fine for an offence, except that such regulations may make provision about the maximum amount referring to the standard scale, the statutory maximum or a similar amount.
- (3) Regulations under this Part may not require or enable a person to set the amount or maximum amount of, or of an increase in, a penalty or fee or to set the method for determining such an amount, except as provided by subsection [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/21/4/2025-09-30) and sections [11](https://www.legislation.gov.uk/ukpga/2025/18/section/11/2025-09-30)[(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/9/2025-09-30), [15](https://www.legislation.gov.uk/ukpga/2025/18/section/15/2025-09-30) and [16](https://www.legislation.gov.uk/ukpga/2025/18/section/16/2025-09-30).
- (3) Regulations under this Part may not require or enable a person to set the amount or maximum amount of, or of an increase in, a penalty or fee or to set the method for determining such an amount, except as provided by subsection [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/21/4/2025-11-17) and sections [11](https://www.legislation.gov.uk/ukpga/2025/18/section/11/2025-11-17)[(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/11/9/2025-11-17), [15](https://www.legislation.gov.uk/ukpga/2025/18/section/15/2025-11-17) and [16](https://www.legislation.gov.uk/ukpga/2025/18/section/16/2025-11-17).
- (4) Regulations under this Part—
- (a) may make provision about the amount or method described in subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/21/3/2025-09-30) referring to a published index, and
- (a) may make provision about the amount or method described in subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/21/3/2025-11-17) referring to a published index, and
- (b) may require or enable a person to make decisions, in accordance with a maximum amount or method set out in the regulations, about the amount of, or of an increase or reduction in, a penalty or fee payable in a particular case.
@@ -1030,7 +1030,7 @@
- (c) provision about appeals;
- (d) provision described in [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/21/1/2025-09-30)[(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/21/1/h/2025-09-30).
- (d) provision described in [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/21/1/2025-11-17)[(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/21/1/h/2025-11-17).
#### Regulations under this Part: Parliamentary procedure and consultation
@@ -1038,37 +1038,37 @@
- (1) The following regulations under this Part are subject to the affirmative resolution procedure—
- (a) the first regulations under each of [section 2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/1/2025-09-30), [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/3/2025-09-30) and [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/4/2025-09-30) making provision about a particular description of customer data,
- (b) the first regulations under each of [section 4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/1/2025-09-30), [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/3/2025-09-30) and [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/2025-09-30) making provision about a particular description of business data,
- (c) regulations under [section 2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-09-30) or [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-09-30) which make the requirements of regulations under this Part more onerous for data holders or interface bodies,
- (d) regulations under [section 6](https://www.legislation.gov.uk/ukpga/2025/18/section/6/2025-09-30)[(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/6/5/2025-09-30), [7](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2025-09-30), [8](https://www.legislation.gov.uk/ukpga/2025/18/section/8/2025-09-30), [11](https://www.legislation.gov.uk/ukpga/2025/18/section/11/2025-09-30), [12](https://www.legislation.gov.uk/ukpga/2025/18/section/12/2025-09-30), [14](https://www.legislation.gov.uk/ukpga/2025/18/section/14/2025-09-30), [16](https://www.legislation.gov.uk/ukpga/2025/18/section/16/2025-09-30), [17](https://www.legislation.gov.uk/ukpga/2025/18/section/17/2025-09-30) or [18](https://www.legislation.gov.uk/ukpga/2025/18/section/18/2025-09-30), and
- (e) regulations described in section [21](https://www.legislation.gov.uk/ukpga/2025/18/section/21/2025-09-30)[(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/21/5/2025-09-30) which amend, repeal or revoke primary legislation.
- (a) the first regulations under each of [section 2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/1/2025-11-17), [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/3/2025-11-17) and [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/4/2025-11-17) making provision about a particular description of customer data,
- (b) the first regulations under each of [section 4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/1/2025-11-17), [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/3/2025-11-17) and [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/2025-11-17) making provision about a particular description of business data,
- (c) regulations under [section 2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-11-17) or [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-11-17) which make the requirements of regulations under this Part more onerous for data holders or interface bodies,
- (d) regulations under [section 6](https://www.legislation.gov.uk/ukpga/2025/18/section/6/2025-11-17)[(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/6/5/2025-11-17), [7](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2025-11-17), [8](https://www.legislation.gov.uk/ukpga/2025/18/section/8/2025-11-17), [11](https://www.legislation.gov.uk/ukpga/2025/18/section/11/2025-11-17), [12](https://www.legislation.gov.uk/ukpga/2025/18/section/12/2025-11-17), [14](https://www.legislation.gov.uk/ukpga/2025/18/section/14/2025-11-17), [16](https://www.legislation.gov.uk/ukpga/2025/18/section/16/2025-11-17), [17](https://www.legislation.gov.uk/ukpga/2025/18/section/17/2025-11-17) or [18](https://www.legislation.gov.uk/ukpga/2025/18/section/18/2025-11-17), and
- (e) regulations described in section [21](https://www.legislation.gov.uk/ukpga/2025/18/section/21/2025-11-17)[(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/21/5/2025-11-17) which amend, repeal or revoke primary legislation.
- (2) Other regulations under this Part are subject to the negative resolution procedure.
- (3) Before making regulations described in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/22/1/2025-09-30), the Secretary of State or the Treasury (as the case may be) must consult such of the following as the Secretary of State or the Treasury considers appropriate—
- (3) Before making regulations described in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/22/1/2025-11-17), the Secretary of State or the Treasury (as the case may be) must consult such of the following as the Secretary of State or the Treasury considers appropriate—
- (a) persons likely to be affected by the regulations or representatives of such persons;
- (b) sectoral regulators with functions in relation to data holders likely to be affected by the regulations.
- (4) The requirement in subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/22/3/2025-09-30) may be satisfied by consultation undertaken before the day on which this Act is passed.
- (4) The requirement in subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/22/3/2025-11-17) may be satisfied by consultation undertaken before the day on which this Act is passed.
#### Related subordinate legislation
##### 23
- (1) This section is about cases in which subordinate legislation, other than regulations under this Part, contains provision described in section [2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/1/2025-09-30) to [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/4/2025-09-30) or [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/1/2025-09-30) to [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/2025-09-30) (and such provision is referred to in this section as “*related subordinate legislation*”).
- (2) The regulation-making powers under this Part may be exercised so as to make, in connection with the related subordinate legislation, any provision that they could be exercised to make as part of, or in connection with, provision made under section [2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/1/2025-09-30) to [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/4/2025-09-30) or, as appropriate, section [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/1/2025-09-30) to [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/2025-09-30).
- (3) In this Part, references to “data regulations” include regulations made in reliance on subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/23/2/2025-09-30) to the extent that they make provision described in sections [2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-09-30) to [7](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2025-09-30).
- (4) For the purposes of determining whether subordinate legislation contains provision described in sections [2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/1/2025-09-30) to [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/4/2025-09-30) or [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/1/2025-09-30) to [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/2025-09-30), references in those sections to something specified are to be read as including something specified by or under any subordinate legislation.
- (1) This section is about cases in which subordinate legislation, other than regulations under this Part, contains provision described in section [2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/1/2025-11-17) to [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/4/2025-11-17) or [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/1/2025-11-17) to [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/2025-11-17) (and such provision is referred to in this section as “*related subordinate legislation*”).
- (2) The regulation-making powers under this Part may be exercised so as to make, in connection with the related subordinate legislation, any provision that they could be exercised to make as part of, or in connection with, provision made under section [2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/1/2025-11-17) to [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/4/2025-11-17) or, as appropriate, section [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/1/2025-11-17) to [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/2025-11-17).
- (3) In this Part, references to “data regulations” include regulations made in reliance on subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/23/2/2025-11-17) to the extent that they make provision described in sections [2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-11-17) to [7](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2025-11-17).
- (4) For the purposes of determining whether subordinate legislation contains provision described in sections [2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/1/2025-11-17) to [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/4/2025-11-17) or [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/1/2025-11-17) to [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/2025-11-17), references in those sections to something specified are to be read as including something specified by or under any subordinate legislation.
- (5) In this section, “*subordinate legislation*” has the same meaning as in the Interpretation Act 1978 (see section 21 of that Act).
@@ -1106,7 +1106,7 @@
- “*specified*” means specified, or of a description specified, by regulations under this Part, or in exercise of a power conferred by such regulations, except to the extent otherwise provided in this Part;
- “*third party recipient*” means— in section [3](https://www.legislation.gov.uk/ukpga/2025/18/section/3/2025-09-30), a third party in relation to customer data (see section [2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-09-30)[(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2/2025-09-30)), in sections [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-09-30) and [5](https://www.legislation.gov.uk/ukpga/2025/18/section/5/2025-09-30), a third party recipient in relation to business data (see section [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-09-30)[(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2/2025-09-30)), and in other sections, a third party recipient in relation to customer data or business data (see sections [2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-09-30)[(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2/2025-09-30) and [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-09-30)[(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2/2025-09-30)).
- “*third party recipient*” means— in section [3](https://www.legislation.gov.uk/ukpga/2025/18/section/3/2025-11-17), a third party in relation to customer data (see section [2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-11-17)[(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2/2025-11-17)), in sections [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-11-17) and [5](https://www.legislation.gov.uk/ukpga/2025/18/section/5/2025-11-17), a third party recipient in relation to business data (see section [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-11-17)[(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2/2025-11-17)), and in other sections, a third party recipient in relation to customer data or business data (see sections [2](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2025-11-17)[(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/2/2/2025-11-17) and [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-11-17)[(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2/2025-11-17)).
- (2) In this Part, references to doing something “in the course of a business” include doing something in the course of—
@@ -1124,7 +1124,7 @@
- (d) references to managing standards or arrangements include assisting people to use them or overseeing how they are used.
- (4) In this Part, references to regulations made under subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/3/2025-09-30) of section [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-09-30) or any of sections [5](https://www.legislation.gov.uk/ukpga/2025/18/section/5/2025-09-30) to [21](https://www.legislation.gov.uk/ukpga/2025/18/section/21/2025-09-30) (and references which include such regulations) include regulations made under section [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-09-30)[(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/2025-09-30)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/c/2025-09-30) or [(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/d/2025-09-30) which make provision that could be made under the other subsection or section.
- (4) In this Part, references to regulations made under subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/3/2025-11-17) of section [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-11-17) or any of sections [5](https://www.legislation.gov.uk/ukpga/2025/18/section/5/2025-11-17) to [21](https://www.legislation.gov.uk/ukpga/2025/18/section/21/2025-11-17) (and references which include such regulations) include regulations made under section [4](https://www.legislation.gov.uk/ukpga/2025/18/section/4/2025-11-17)[(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/2025-11-17)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/c/2025-11-17) or [(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/4/4/d/2025-11-17) which make provision that could be made under the other subsection or section.
#### Index of defined terms for this Part
@@ -1134,39 +1134,39 @@
| *Term* | *Provision* |
| --- | --- |
| application programming interface | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-09-30) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/1/2025-09-30) |
| business, in the course of a | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-09-30) [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2/2025-09-30) |
| business data | section [1](https://www.legislation.gov.uk/ukpga/2025/18/section/1/2025-09-30) [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/1/2/2025-09-30) |
| customer | section [1](https://www.legislation.gov.uk/ukpga/2025/18/section/1/2025-09-30) [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/1/3/2025-09-30) |
| customer data | section [1](https://www.legislation.gov.uk/ukpga/2025/18/section/1/2025-09-30) [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/1/2/2025-09-30) |
| dashboard service | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-09-30) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/1/2025-09-30) |
| data holder | section [1](https://www.legislation.gov.uk/ukpga/2025/18/section/1/2025-09-30) [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/1/2/2025-09-30) |
| data regulations | sections [1](https://www.legislation.gov.uk/ukpga/2025/18/section/1/2025-09-30) [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/1/2/2025-09-30) and [23](https://www.legislation.gov.uk/ukpga/2025/18/section/23/2025-09-30) [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/23/3/2025-09-30) |
| decision-maker | section [6](https://www.legislation.gov.uk/ukpga/2025/18/section/6/2025-09-30) [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/6/2/2025-09-30) |
| digital content | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-09-30) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/1/2025-09-30) |
| electronic communications service | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-09-30) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/1/2025-09-30) |
| enforcer | section [8](https://www.legislation.gov.uk/ukpga/2025/18/section/8/2025-09-30) [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/8/2/2025-09-30) |
| the FCA | section [14](https://www.legislation.gov.uk/ukpga/2025/18/section/14/2025-09-30) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/14/1/2025-09-30) |
| FCA additional requirement | section [14](https://www.legislation.gov.uk/ukpga/2025/18/section/14/2025-09-30) [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/14/6/2025-09-30) |
| FCA interface rules | section [14](https://www.legislation.gov.uk/ukpga/2025/18/section/14/2025-09-30) [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/14/2/2025-09-30) |
| goods | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-09-30) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/1/2025-09-30) |
| interface | section [7](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2025-09-30) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/7/1/2025-09-30) |
| interface arrangements | section [7](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2025-09-30) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/7/1/2025-09-30) |
| interface body | section [7](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2025-09-30) [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2/2025-09-30) |
| interface standards | section [7](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2025-09-30) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/7/1/2025-09-30) |
| making arrangements | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-09-30) [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/3/2025-09-30) |
| managing (facilities, services, standards or arrangements) | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-09-30) [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/3/2025-09-30) |
| micro business | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-09-30) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/1/2025-09-30) |
| monitoring powers (in sections [6](https://www.legislation.gov.uk/ukpga/2025/18/section/6/2025-09-30) and [7](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2025-09-30)) | section [6](https://www.legislation.gov.uk/ukpga/2025/18/section/6/2025-09-30) [(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/6/5/2025-09-30) or [7](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2025-09-30) [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/7/4/2025-09-30) [(g)](https://www.legislation.gov.uk/ukpga/2025/18/section/7/4/g/2025-09-30) (as appropriate) |
| primary legislation | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-09-30) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/1/2025-09-30) |
| processing | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-09-30) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/1/2025-09-30) |
| providing customer data or business data | section [1](https://www.legislation.gov.uk/ukpga/2025/18/section/1/2025-09-30) [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/1/6/2025-09-30) [(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/1/6/a/2025-09-30) |
| public authority | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-09-30) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/1/2025-09-30) |
| receiving customer data or business data | section [1](https://www.legislation.gov.uk/ukpga/2025/18/section/1/2025-09-30) [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/1/6/2025-09-30) [(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/1/6/b/2025-09-30) |
| small business | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-09-30) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/1/2025-09-30) |
| specified | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-09-30) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/1/2025-09-30) |
| third party recipient | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-09-30) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/1/2025-09-30) |
| trader | section [1](https://www.legislation.gov.uk/ukpga/2025/18/section/1/2025-09-30) [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/1/2/2025-09-30) |
| application programming interface | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-11-17) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/1/2025-11-17) |
| business, in the course of a | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-11-17) [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2/2025-11-17) |
| business data | section [1](https://www.legislation.gov.uk/ukpga/2025/18/section/1/2025-11-17) [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/1/2/2025-11-17) |
| customer | section [1](https://www.legislation.gov.uk/ukpga/2025/18/section/1/2025-11-17) [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/1/3/2025-11-17) |
| customer data | section [1](https://www.legislation.gov.uk/ukpga/2025/18/section/1/2025-11-17) [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/1/2/2025-11-17) |
| dashboard service | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-11-17) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/1/2025-11-17) |
| data holder | section [1](https://www.legislation.gov.uk/ukpga/2025/18/section/1/2025-11-17) [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/1/2/2025-11-17) |
| data regulations | sections [1](https://www.legislation.gov.uk/ukpga/2025/18/section/1/2025-11-17) [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/1/2/2025-11-17) and [23](https://www.legislation.gov.uk/ukpga/2025/18/section/23/2025-11-17) [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/23/3/2025-11-17) |
| decision-maker | section [6](https://www.legislation.gov.uk/ukpga/2025/18/section/6/2025-11-17) [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/6/2/2025-11-17) |
| digital content | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-11-17) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/1/2025-11-17) |
| electronic communications service | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-11-17) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/1/2025-11-17) |
| enforcer | section [8](https://www.legislation.gov.uk/ukpga/2025/18/section/8/2025-11-17) [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/8/2/2025-11-17) |
| the FCA | section [14](https://www.legislation.gov.uk/ukpga/2025/18/section/14/2025-11-17) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/14/1/2025-11-17) |
| FCA additional requirement | section [14](https://www.legislation.gov.uk/ukpga/2025/18/section/14/2025-11-17) [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/14/6/2025-11-17) |
| FCA interface rules | section [14](https://www.legislation.gov.uk/ukpga/2025/18/section/14/2025-11-17) [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/14/2/2025-11-17) |
| goods | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-11-17) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/1/2025-11-17) |
| interface | section [7](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2025-11-17) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/7/1/2025-11-17) |
| interface arrangements | section [7](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2025-11-17) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/7/1/2025-11-17) |
| interface body | section [7](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2025-11-17) [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2/2025-11-17) |
| interface standards | section [7](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2025-11-17) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/7/1/2025-11-17) |
| making arrangements | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-11-17) [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/3/2025-11-17) |
| managing (facilities, services, standards or arrangements) | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-11-17) [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/3/2025-11-17) |
| micro business | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-11-17) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/1/2025-11-17) |
| monitoring powers (in sections [6](https://www.legislation.gov.uk/ukpga/2025/18/section/6/2025-11-17) and [7](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2025-11-17)) | section [6](https://www.legislation.gov.uk/ukpga/2025/18/section/6/2025-11-17) [(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/6/5/2025-11-17) or [7](https://www.legislation.gov.uk/ukpga/2025/18/section/7/2025-11-17) [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/7/4/2025-11-17) [(g)](https://www.legislation.gov.uk/ukpga/2025/18/section/7/4/g/2025-11-17) (as appropriate) |
| primary legislation | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-11-17) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/1/2025-11-17) |
| processing | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-11-17) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/1/2025-11-17) |
| providing customer data or business data | section [1](https://www.legislation.gov.uk/ukpga/2025/18/section/1/2025-11-17) [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/1/6/2025-11-17) [(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/1/6/a/2025-11-17) |
| public authority | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-11-17) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/1/2025-11-17) |
| receiving customer data or business data | section [1](https://www.legislation.gov.uk/ukpga/2025/18/section/1/2025-11-17) [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/1/6/2025-11-17) [(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/1/6/b/2025-11-17) |
| small business | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-11-17) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/1/2025-11-17) |
| specified | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-11-17) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/1/2025-11-17) |
| third party recipient | section [25](https://www.legislation.gov.uk/ukpga/2025/18/section/25/2025-11-17) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/25/1/2025-11-17) |
| trader | section [1](https://www.legislation.gov.uk/ukpga/2025/18/section/1/2025-11-17) [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/1/2/2025-11-17) |
## Part 2 — Digital verification services
@@ -1178,19 +1178,19 @@
- (1) This Part contains provision to secure the reliability of digital verification services by means of—
- (a) a trust framework (see [section 28](https://www.legislation.gov.uk/ukpga/2025/18/section/28/2025-09-30)),
- (b) supplementary codes (see section [29](https://www.legislation.gov.uk/ukpga/2025/18/section/29/2025-09-30)),
- (c) a register (see [section 32](https://www.legislation.gov.uk/ukpga/2025/18/section/32/2025-09-30)),
- (d) an information gateway (see [section 45](https://www.legislation.gov.uk/ukpga/2025/18/section/45/2025-09-30)), and
- (e) a trust mark (see [section 50](https://www.legislation.gov.uk/ukpga/2025/18/section/50/2025-09-30)).
- (a) a trust framework (see [section 28](https://www.legislation.gov.uk/ukpga/2025/18/section/28/2025-11-17)),
- (b) supplementary codes (see section [29](https://www.legislation.gov.uk/ukpga/2025/18/section/29/2025-11-17)),
- (c) a register (see [section 32](https://www.legislation.gov.uk/ukpga/2025/18/section/32/2025-11-17)),
- (d) an information gateway (see [section 45](https://www.legislation.gov.uk/ukpga/2025/18/section/45/2025-11-17)), and
- (e) a trust mark (see [section 50](https://www.legislation.gov.uk/ukpga/2025/18/section/50/2025-11-17)).
- (2) In this Part, “*digital verification services*” means verification services provided to any extent by means of the internet.
- (3) In subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/27/2/2025-09-30), “*verification services*” means services that are provided at the request of an individual and consist in—
- (3) In subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/27/2/2025-11-17), “*verification services*” means services that are provided at the request of an individual and consist in—
- (a) ascertaining or verifying a fact about the individual from information provided otherwise than by the individual, and
@@ -1212,9 +1212,9 @@
- (b) such other persons as the Secretary of State considers appropriate.
- (4) The requirement in [subsection (3)](https://www.legislation.gov.uk/ukpga/2025/18/section/28/3/2025-09-30) may be satisfied by consultation undertaken before the coming into force of this section.
- (5) The Secretary of State may revise and republish the DVS trust framework (whether following a review under section [31](https://www.legislation.gov.uk/ukpga/2025/18/section/31/2025-09-30) or otherwise).
- (4) The requirement in [subsection (3)](https://www.legislation.gov.uk/ukpga/2025/18/section/28/3/2025-11-17) may be satisfied by consultation undertaken before the coming into force of this section.
- (5) The Secretary of State may revise and republish the DVS trust framework (whether following a review under section [31](https://www.legislation.gov.uk/ukpga/2025/18/section/31/2025-11-17) or otherwise).
- (6) The DVS trust framework, and any revised version of the framework, must specify the time it comes into force (which must not be a time earlier than the time it is published).
@@ -1226,15 +1226,15 @@
- (c) make transitional or saving provision.
- (8) Where the Secretary of State revises and republishes the DVS trust framework, the DVS trust framework (as revised) may provide that from a date, or from the end of a period, specified in the framework a pre-revision certificate is required to be ignored for the purposes of sections [33](https://www.legislation.gov.uk/ukpga/2025/18/section/33/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/33/1/2025-09-30)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/33/1/a/2025-09-30), [35](https://www.legislation.gov.uk/ukpga/2025/18/section/35/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/35/1/2025-09-30)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/35/1/c/2025-09-30), [40](https://www.legislation.gov.uk/ukpga/2025/18/section/40/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/40/1/2025-09-30)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/40/1/c/2025-09-30) and [42](https://www.legislation.gov.uk/ukpga/2025/18/section/42/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/42/1/2025-09-30)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/42/1/c/2025-09-30).
- (9) In subsection [(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/28/8/2025-09-30), a “*pre-revision certificate*” means a certificate which—
- (8) Where the Secretary of State revises and republishes the DVS trust framework, the DVS trust framework (as revised) may provide that from a date, or from the end of a period, specified in the framework a pre-revision certificate is required to be ignored for the purposes of sections [33](https://www.legislation.gov.uk/ukpga/2025/18/section/33/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/33/1/2025-11-17)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/33/1/a/2025-11-17), [35](https://www.legislation.gov.uk/ukpga/2025/18/section/35/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/35/1/2025-11-17)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/35/1/c/2025-11-17), [40](https://www.legislation.gov.uk/ukpga/2025/18/section/40/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/40/1/2025-11-17)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/40/1/c/2025-11-17) and [42](https://www.legislation.gov.uk/ukpga/2025/18/section/42/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/42/1/2025-11-17)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/42/1/c/2025-11-17).
- (9) In subsection [(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/28/8/2025-11-17), a “*pre-revision certificate*” means a certificate which—
- (a) certifies that digital verification services provided by the holder of the certificate are provided in accordance with the DVS trust framework, and
- (b) was issued before the time the relevant revision to the DVS trust framework comes into force.
- (10) Provision included in the DVS trust framework in reliance on subsection [(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/28/8/2025-09-30) may make different provision in relation to different descriptions of pre-revision certificate.
- (10) Provision included in the DVS trust framework in reliance on subsection [(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/28/8/2025-11-17) may make different provision in relation to different descriptions of pre-revision certificate.
#### Supplementary codes
@@ -1242,7 +1242,7 @@
- (1) The Secretary of State may prepare and publish one or more sets of rules concerning the provision of digital verification services which supplement the DVS trust framework.
- (2) In this Part, a set of rules published under subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/29/1/2025-09-30) is referred to as a supplementary code.
- (2) In this Part, a set of rules published under subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/29/1/2025-11-17) is referred to as a supplementary code.
- (3) Those rules may include (among other things) rules relating to, and to the conduct of, a person who provides such services; and in this Part references to a person providing services in accordance with a supplementary code (however expressed) include a person complying with such rules.
@@ -1252,9 +1252,9 @@
- (b) such other persons as the Secretary of State considers appropriate.
- (5) The requirement in subsection [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/29/4/2025-09-30) may be satisfied by consultation undertaken before the coming into force of this section.
- (6) The Secretary of State may revise and republish a supplementary code (whether following a review under section [31](https://www.legislation.gov.uk/ukpga/2025/18/section/31/2025-09-30) or otherwise).
- (5) The requirement in subsection [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/29/4/2025-11-17) may be satisfied by consultation undertaken before the coming into force of this section.
- (6) The Secretary of State may revise and republish a supplementary code (whether following a review under section [31](https://www.legislation.gov.uk/ukpga/2025/18/section/31/2025-11-17) or otherwise).
- (7) A supplementary code, and any revised version of a supplementary code, must specify the time it comes into force (which must not be a time earlier than the time it is published).
@@ -1266,15 +1266,15 @@
- (c) make transitional or saving provision.
- (9) Where the Secretary of State revises and republishes a supplementary code, the supplementary code (as revised) may provide that from a date, or from the end of a period, specified in the code a pre-revision certificate is required to be ignored for the purposes of sections [36](https://www.legislation.gov.uk/ukpga/2025/18/section/36/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/36/1/2025-09-30)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/36/1/a/2025-09-30), [37](https://www.legislation.gov.uk/ukpga/2025/18/section/37/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/37/1/2025-09-30)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/37/1/c/2025-09-30), [43](https://www.legislation.gov.uk/ukpga/2025/18/section/43/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/43/1/2025-09-30)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/43/1/c/2025-09-30)and [44](https://www.legislation.gov.uk/ukpga/2025/18/section/44/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/44/1/2025-09-30)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/44/1/c/2025-09-30).
- (10) In subsection [(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/29/9/2025-09-30), a “*pre-revision certificate*” means a certificate which—
- (9) Where the Secretary of State revises and republishes a supplementary code, the supplementary code (as revised) may provide that from a date, or from the end of a period, specified in the code a pre-revision certificate is required to be ignored for the purposes of sections [36](https://www.legislation.gov.uk/ukpga/2025/18/section/36/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/36/1/2025-11-17)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/36/1/a/2025-11-17), [37](https://www.legislation.gov.uk/ukpga/2025/18/section/37/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/37/1/2025-11-17)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/37/1/c/2025-11-17), [43](https://www.legislation.gov.uk/ukpga/2025/18/section/43/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/43/1/2025-11-17)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/43/1/c/2025-11-17)and [44](https://www.legislation.gov.uk/ukpga/2025/18/section/44/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/44/1/2025-11-17)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/44/1/c/2025-11-17).
- (10) In subsection [(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/29/9/2025-11-17), a “*pre-revision certificate*” means a certificate which—
- (a) certifies that digital verification services provided by the holder of the certificate are provided in accordance with the supplementary code, and
- (b) was issued before the time the relevant revision to the supplementary code comes into force.
- (11) Provision included in a supplementary code in reliance on subsection [(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/29/9/2025-09-30) may make different provision in relation to different descriptions of pre-revision certificate.
- (11) Provision included in a supplementary code in reliance on subsection [(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/29/9/2025-11-17) may make different provision in relation to different descriptions of pre-revision certificate.
#### Withdrawal of a supplementary code
@@ -1298,7 +1298,7 @@
- (b) at the same time, carry out a review of each supplementary code which has not been withdrawn.
- (2) In carrying out a review under subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/31/1/2025-09-30), the Secretary of State must consult—
- (2) In carrying out a review under subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/31/1/2025-11-17), the Secretary of State must consult—
- (a) the Information Commissioner, and
@@ -1326,31 +1326,31 @@
- (b) the person applies to be registered in the DVS register in respect of one or more of the digital verification services to which the certificate relates,
- (c) the application complies with any requirements imposed by a determination under [section 38](https://www.legislation.gov.uk/ukpga/2025/18/section/38/2025-09-30), and
- (d) the person complies with any regulations under [section 39](https://www.legislation.gov.uk/ukpga/2025/18/section/39/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/39/1/2025-09-30) requiring a fee to be paid.
- (2) But subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/33/1/2025-09-30) is subject to—
- (a) the power to refuse registration under section [34](https://www.legislation.gov.uk/ukpga/2025/18/section/34/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/1/2025-09-30), and
- (b) the duties to refuse registration under sections [34](https://www.legislation.gov.uk/ukpga/2025/18/section/34/2025-09-30)[(10)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/10/2025-09-30) and [41](https://www.legislation.gov.uk/ukpga/2025/18/section/41/2025-09-30)[(10)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/10/2025-09-30).
- (3) If the conditions in paragraphs [(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/33/1/a/2025-09-30) to [(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/33/1/d/2025-09-30) of subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/33/1/2025-09-30) are not met, the Secretary of State may not register a person in the DVS register.
- (c) the application complies with any requirements imposed by a determination under [section 38](https://www.legislation.gov.uk/ukpga/2025/18/section/38/2025-11-17), and
- (d) the person complies with any regulations under [section 39](https://www.legislation.gov.uk/ukpga/2025/18/section/39/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/39/1/2025-11-17) requiring a fee to be paid.
- (2) But subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/33/1/2025-11-17) is subject to—
- (a) the power to refuse registration under section [34](https://www.legislation.gov.uk/ukpga/2025/18/section/34/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/1/2025-11-17), and
- (b) the duties to refuse registration under sections [34](https://www.legislation.gov.uk/ukpga/2025/18/section/34/2025-11-17)[(10)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/10/2025-11-17) and [41](https://www.legislation.gov.uk/ukpga/2025/18/section/41/2025-11-17)[(10)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/10/2025-11-17).
- (3) If the conditions in paragraphs [(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/33/1/a/2025-11-17) to [(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/33/1/d/2025-11-17) of subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/33/1/2025-11-17) are not met, the Secretary of State may not register a person in the DVS register.
- (4) The register must record the digital verification services in respect of which a person is, from time to time, registered.
- (5) For the purposes of [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/33/1/2025-09-30)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/33/1/a/2025-09-30), a certificate is to be ignored if—
- (5) For the purposes of [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/33/1/2025-11-17)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/33/1/a/2025-11-17), a certificate is to be ignored if—
- (a) it has expired in accordance with its terms,
- (b) it has been withdrawn by the body that issued it, or
- (c) it is required to be ignored by reason of provision included in the DVS trust framework under [section 28](https://www.legislation.gov.uk/ukpga/2025/18/section/28/2025-09-30)[(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/28/8/2025-09-30).
- (c) it is required to be ignored by reason of provision included in the DVS trust framework under [section 28](https://www.legislation.gov.uk/ukpga/2025/18/section/28/2025-11-17)[(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/28/8/2025-11-17).
- (6) In this Part, “*accredited conformity assessment body*” means a conformity assessment body that is accredited by the UK national accreditation body in accordance with Article 5 of the Accreditation Regulation as competent to carry out assessments of whether digital verification services are provided in accordance with the DVS trust framework.
- (7) In subsection [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/33/6/2025-09-30)—
- (7) In subsection [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/33/6/2025-11-17)—
- “*the Accreditation Regulation*” means Regulation [(EC) No 765/2008](https://www.legislation.gov.uk/european/regulation/2008/0765) of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation [(EEC) No 339/93](https://www.legislation.gov.uk/european/regulation/1993/0339);
@@ -1378,23 +1378,23 @@
- (i) considers that it is necessary to refuse to register the person in the interests of national security, or
- (ii) is satisfied that the person is failing as mentioned in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/1/2025-09-30)[(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/1/b/2025-09-30),
- (c) state whether the Secretary of State intends to specify a period in the notice under subsection [(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/8/2025-09-30) and, if so, what period is intended to be specified,
- (ii) is satisfied that the person is failing as mentioned in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/1/2025-11-17)[(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/1/b/2025-11-17),
- (c) state whether the Secretary of State intends to specify a period in the notice under subsection [(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/8/2025-11-17) and, if so, what period is intended to be specified,
- (d) state that the person may make written representations to the Secretary of State about—
- (i) the Secretary of State’s intention to refuse to register the person in the DVS register, and
- (ii) where relevant, the period the Secretary of State intends to specify in the notice under subsection [(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/8/2025-09-30), and
- (ii) where relevant, the period the Secretary of State intends to specify in the notice under subsection [(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/8/2025-11-17), and
- (e) specify the period within which such representations may be made.
- (4) Where the Secretary of State intends to refuse to register a person in reliance on subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/1/2025-09-30)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/1/a/2025-09-30), the requirement in subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/3/2025-09-30)[(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/3/b/2025-09-30) does not apply if, or to the extent that, the Secretary of State considers that stating the reason described in subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/3/2025-09-30)[(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/3/b/2025-09-30)[(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/3/b/i/2025-09-30) would be contrary to the interests of national security.
- (4) Where the Secretary of State intends to refuse to register a person in reliance on subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/1/2025-11-17)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/1/a/2025-11-17), the requirement in subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/3/2025-11-17)[(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/3/b/2025-11-17) does not apply if, or to the extent that, the Secretary of State considers that stating the reason described in subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/3/2025-11-17)[(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/3/b/2025-11-17)[(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/3/b/i/2025-11-17) would be contrary to the interests of national security.
- (5) The period specified for making written representations must be a period of not less than 21 days beginning with the day on which the notice is given.
- (6) If the Secretary of State considers that it is appropriate for the person to have an opportunity to make oral representations about the matters mentioned in subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/3/2025-09-30)[(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/3/d/2025-09-30), the notice must also—
- (6) If the Secretary of State considers that it is appropriate for the person to have an opportunity to make oral representations about the matters mentioned in subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/3/2025-11-17)[(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/3/d/2025-11-17), the notice must also—
- (a) state that the person may make such representations, and
@@ -1404,17 +1404,17 @@
- (8) Where the Secretary of State refuses to register the person in the DVS register under this section, the Secretary of State must by written notice inform the person that the person’s application for registration has been refused.
- (9) The Secretary of State may, in the notice given under subsection [(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/8/2025-09-30), state that any further application for registration made by the person during a period specified in the notice will be refused.
- (10) If the person applies to be registered in the DVS register during the period specified in the notice in reliance on subsection [(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/9/2025-09-30), the Secretary of State must refuse the application.
- (11) The period specified in the notice in reliance on subsection [(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/9/2025-09-30) must begin with the day on which the notice is given and must not exceed two years.
- (9) The Secretary of State may, in the notice given under subsection [(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/8/2025-11-17), state that any further application for registration made by the person during a period specified in the notice will be refused.
- (10) If the person applies to be registered in the DVS register during the period specified in the notice in reliance on subsection [(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/9/2025-11-17), the Secretary of State must refuse the application.
- (11) The period specified in the notice in reliance on subsection [(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/34/9/2025-11-17) must begin with the day on which the notice is given and must not exceed two years.
#### Registration of additional services
##### 35
- (1) Subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/35/2/2025-09-30) applies if—
- (1) Subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/35/2/2025-11-17) applies if—
- (a) a person is registered in the DVS register,
@@ -1422,57 +1422,57 @@
- (c) the person holds a certificate from an accredited conformity assessment body certifying that the person provides the additional services in accordance with the DVS trust framework,
- (d) the application complies with any requirements imposed by a determination under section [38](https://www.legislation.gov.uk/ukpga/2025/18/section/38/2025-09-30), and
- (e) the person complies with any regulations under section [39](https://www.legislation.gov.uk/ukpga/2025/18/section/39/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/39/1/2025-09-30) requiring a fee to be paid.
- (2) The Secretary of State must amend the DVS register to record that the person is also registered in respect of the additional services referred to in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/35/1/2025-09-30).
- (3) If the conditions in paragraphs [(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/35/1/a/2025-09-30) to [(e)](https://www.legislation.gov.uk/ukpga/2025/18/section/35/1/e/2025-09-30) of subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/35/1/2025-09-30) are not met, the Secretary of State may not amend the DVS register as described in subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/35/2/2025-09-30).
- (4) For the purposes of subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/35/1/2025-09-30)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/35/1/c/2025-09-30), a certificate is to be ignored if—
- (d) the application complies with any requirements imposed by a determination under section [38](https://www.legislation.gov.uk/ukpga/2025/18/section/38/2025-11-17), and
- (e) the person complies with any regulations under section [39](https://www.legislation.gov.uk/ukpga/2025/18/section/39/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/39/1/2025-11-17) requiring a fee to be paid.
- (2) The Secretary of State must amend the DVS register to record that the person is also registered in respect of the additional services referred to in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/35/1/2025-11-17).
- (3) If the conditions in paragraphs [(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/35/1/a/2025-11-17) to [(e)](https://www.legislation.gov.uk/ukpga/2025/18/section/35/1/e/2025-11-17) of subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/35/1/2025-11-17) are not met, the Secretary of State may not amend the DVS register as described in subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/35/2/2025-11-17).
- (4) For the purposes of subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/35/1/2025-11-17)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/35/1/c/2025-11-17), a certificate is to be ignored if—
- (a) it has expired in accordance with its terms,
- (b) it has been withdrawn by the body that issued it, or
- (c) it is required to be ignored by reason of provision included in the DVS trust framework under section [28](https://www.legislation.gov.uk/ukpga/2025/18/section/28/2025-09-30)[(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/28/8/2025-09-30).
- (c) it is required to be ignored by reason of provision included in the DVS trust framework under section [28](https://www.legislation.gov.uk/ukpga/2025/18/section/28/2025-11-17)[(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/28/8/2025-11-17).
#### Supplementary notes
##### 36
- (1) Subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/36/2/2025-09-30) applies if—
- (1) Subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/36/2/2025-11-17) applies if—
- (a) a person holds a certificate from an accredited conformity assessment body certifying that digital verification services provided by the person are provided in accordance with a supplementary code,
- (b) the person applies for a note about one or more of the services to which the certificate relates to be included in the entry relating to that person in the DVS register,
- (c) the application complies with any requirements imposed by a determination under section [38](https://www.legislation.gov.uk/ukpga/2025/18/section/38/2025-09-30), and
- (d) the person complies with any regulations under section [39](https://www.legislation.gov.uk/ukpga/2025/18/section/39/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/39/1/2025-09-30) requiring a fee to be paid.
- (2) The Secretary of State must include a note in the entry relating to the person in the DVS register recording that the person provides, in accordance with the supplementary code referred to in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/36/1/2025-09-30), the services in respect of which the person made the application referred to in that subsection.
- (3) But subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/36/2/2025-09-30) does not apply if the supplementary code referred to in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/36/1/2025-09-30) has been withdrawn.
- (4) If the conditions in paragraphs [(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/36/1/a/2025-09-30) to [(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/36/1/d/2025-09-30) of subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/36/1/2025-09-30) are not met, the Secretary of State may not include a note described in subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/36/2/2025-09-30) in the DVS register.
- (5) For the purposes of subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/36/1/2025-09-30)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/36/1/a/2025-09-30), a certificate is to be ignored if—
- (c) the application complies with any requirements imposed by a determination under section [38](https://www.legislation.gov.uk/ukpga/2025/18/section/38/2025-11-17), and
- (d) the person complies with any regulations under section [39](https://www.legislation.gov.uk/ukpga/2025/18/section/39/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/39/1/2025-11-17) requiring a fee to be paid.
- (2) The Secretary of State must include a note in the entry relating to the person in the DVS register recording that the person provides, in accordance with the supplementary code referred to in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/36/1/2025-11-17), the services in respect of which the person made the application referred to in that subsection.
- (3) But subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/36/2/2025-11-17) does not apply if the supplementary code referred to in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/36/1/2025-11-17) has been withdrawn.
- (4) If the conditions in paragraphs [(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/36/1/a/2025-11-17) to [(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/36/1/d/2025-11-17) of subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/36/1/2025-11-17) are not met, the Secretary of State may not include a note described in subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/36/2/2025-11-17) in the DVS register.
- (5) For the purposes of subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/36/1/2025-11-17)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/36/1/a/2025-11-17), a certificate is to be ignored if—
- (a) it has expired in accordance with its terms,
- (b) it has been withdrawn by the body that issued it, or
- (c) it is required to be ignored by reason of provision included in the supplementary code as a result of section [29](https://www.legislation.gov.uk/ukpga/2025/18/section/29/2025-09-30)[(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/29/9/2025-09-30).
- (6) In this Part, a note included in the DVS register in accordance with subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/36/2/2025-09-30) is referred to as a supplementary note.
- (c) it is required to be ignored by reason of provision included in the supplementary code as a result of section [29](https://www.legislation.gov.uk/ukpga/2025/18/section/29/2025-11-17)[(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/29/9/2025-11-17).
- (6) In this Part, a note included in the DVS register in accordance with subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/36/2/2025-11-17) is referred to as a supplementary note.
#### Addition of services to supplementary notes
##### 37
- (1) Subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/37/2/2025-09-30) applies if—
- (1) Subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/37/2/2025-11-17) applies if—
- (a) a person has a supplementary note included in the DVS register relating to a supplementary code,
@@ -1480,23 +1480,23 @@
- (c) the person holds a certificate from an accredited conformity assessment body certifying that the person provides the additional services in accordance with that code,
- (d) the application complies with any requirements imposed by a determination under section [38](https://www.legislation.gov.uk/ukpga/2025/18/section/38/2025-09-30), and
- (e) the person complies with any regulations under section [39](https://www.legislation.gov.uk/ukpga/2025/18/section/39/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/39/1/2025-09-30) requiring a fee to be paid.
- (2) The Secretary of State must amend the note to record that the person also provides the additional services referred to in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/37/1/2025-09-30) in accordance with the supplementary code to which the note relates.
- (3) But subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/37/2/2025-09-30) does not apply if the supplementary code to which the note relates has been withdrawn.
- (4) If the conditions in paragraphs [(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/37/1/a/2025-09-30) to [(e)](https://www.legislation.gov.uk/ukpga/2025/18/section/37/1/e/2025-09-30) of subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/37/1/2025-09-30) are not met, the Secretary of State may not amend the note as described in subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/37/2/2025-09-30).
- (5) For the purposes of subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/37/1/2025-09-30)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/37/1/c/2025-09-30), a certificate is to be ignored if—
- (d) the application complies with any requirements imposed by a determination under section [38](https://www.legislation.gov.uk/ukpga/2025/18/section/38/2025-11-17), and
- (e) the person complies with any regulations under section [39](https://www.legislation.gov.uk/ukpga/2025/18/section/39/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/39/1/2025-11-17) requiring a fee to be paid.
- (2) The Secretary of State must amend the note to record that the person also provides the additional services referred to in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/37/1/2025-11-17) in accordance with the supplementary code to which the note relates.
- (3) But subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/37/2/2025-11-17) does not apply if the supplementary code to which the note relates has been withdrawn.
- (4) If the conditions in paragraphs [(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/37/1/a/2025-11-17) to [(e)](https://www.legislation.gov.uk/ukpga/2025/18/section/37/1/e/2025-11-17) of subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/37/1/2025-11-17) are not met, the Secretary of State may not amend the note as described in subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/37/2/2025-11-17).
- (5) For the purposes of subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/37/1/2025-11-17)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/37/1/c/2025-11-17), a certificate is to be ignored if—
- (a) it has expired in accordance with its terms,
- (b) it has been withdrawn by the body that issued it, or
- (c) it is required to be ignored by reason of provision included in the supplementary code as a result of section [29](https://www.legislation.gov.uk/ukpga/2025/18/section/29/2025-09-30)[(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/29/9/2025-09-30).
- (c) it is required to be ignored by reason of provision included in the supplementary code as a result of section [29](https://www.legislation.gov.uk/ukpga/2025/18/section/29/2025-11-17)[(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/29/9/2025-11-17).
#### Applications for registration, supplementary notes, etc
@@ -1504,7 +1504,7 @@
- (1) The Secretary of State may determine—
- (a) the form of an application under section [33](https://www.legislation.gov.uk/ukpga/2025/18/section/33/2025-09-30), [35](https://www.legislation.gov.uk/ukpga/2025/18/section/35/2025-09-30), [36](https://www.legislation.gov.uk/ukpga/2025/18/section/36/2025-09-30) or [37](https://www.legislation.gov.uk/ukpga/2025/18/section/37/2025-09-30),
- (a) the form of an application under section [33](https://www.legislation.gov.uk/ukpga/2025/18/section/33/2025-11-17), [35](https://www.legislation.gov.uk/ukpga/2025/18/section/35/2025-11-17), [36](https://www.legislation.gov.uk/ukpga/2025/18/section/36/2025-11-17) or [37](https://www.legislation.gov.uk/ukpga/2025/18/section/37/2025-11-17),
- (b) the information to be contained in or provided with the application,
@@ -1526,7 +1526,7 @@
- (1) The Secretary of State may by regulations make provision for or in connection with—
- (a) the payment of fees for applications under sections [33](https://www.legislation.gov.uk/ukpga/2025/18/section/33/2025-09-30), [35](https://www.legislation.gov.uk/ukpga/2025/18/section/35/2025-09-30), [36](https://www.legislation.gov.uk/ukpga/2025/18/section/36/2025-09-30) and [37](https://www.legislation.gov.uk/ukpga/2025/18/section/37/2025-09-30), and
- (a) the payment of fees for applications under sections [33](https://www.legislation.gov.uk/ukpga/2025/18/section/33/2025-11-17), [35](https://www.legislation.gov.uk/ukpga/2025/18/section/35/2025-11-17), [36](https://www.legislation.gov.uk/ukpga/2025/18/section/36/2025-11-17) and [37](https://www.legislation.gov.uk/ukpga/2025/18/section/37/2025-11-17), and
- (b) the payment of fees in connection with continued registration in the DVS register.
@@ -1540,7 +1540,7 @@
- (4) The regulations may provide for the amount of a fee to exceed the administrative costs of determining the application or the administrative costs associated with the continued registration (as the case may be).
- (5) Regulations under subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/39/1/2025-09-30) may (among other things) make provision about the following—
- (5) Regulations under subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/39/1/2025-11-17) may (among other things) make provision about the following—
- (a) when fees are to be paid;
@@ -1554,9 +1554,9 @@
- (f) interest on any unpaid amounts,
including provision conferring functions on the Secretary of State in relation to the matters in paragraphs [(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/39/5/a/2025-09-30) to [(e)](https://www.legislation.gov.uk/ukpga/2025/18/section/39/5/e/2025-09-30).
- (6) A fee payable under regulations made under subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/39/1/2025-09-30)[(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/39/1/b/2025-09-30), and any interest payable in respect of it, is recoverable summarily (or, in Scotland, recoverable) as a civil debt.
including provision conferring functions on the Secretary of State in relation to the matters in paragraphs [(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/39/5/a/2025-11-17) to [(e)](https://www.legislation.gov.uk/ukpga/2025/18/section/39/5/e/2025-11-17).
- (6) A fee payable under regulations made under subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/39/1/2025-11-17)[(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/39/1/b/2025-11-17), and any interest payable in respect of it, is recoverable summarily (or, in Scotland, recoverable) as a civil debt.
- (7) The regulations may—
@@ -1578,13 +1578,13 @@
- (c) no longer holds a certificate from an accredited conformity assessment body certifying that at least one of those digital verification services is provided in accordance with the DVS trust framework.
- (2) For the purposes of [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/40/1/2025-09-30)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/40/1/c/2025-09-30), a certificate is to be ignored if—
- (2) For the purposes of [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/40/1/2025-11-17)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/40/1/c/2025-11-17), a certificate is to be ignored if—
- (a) it has expired in accordance with its terms,
- (b) it has been withdrawn by the body that issued it, or
- (c) it is required to be ignored by reason of provision included in the DVS trust framework under section [28](https://www.legislation.gov.uk/ukpga/2025/18/section/28/2025-09-30)[(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/28/8/2025-09-30).
- (c) it is required to be ignored by reason of provision included in the DVS trust framework under section [28](https://www.legislation.gov.uk/ukpga/2025/18/section/28/2025-11-17)[(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/28/8/2025-11-17).
#### Power to remove person from the DVS register
@@ -1596,7 +1596,7 @@
- (b) the person has a supplementary note included in the DVS register and the Secretary of State is satisfied that the person is failing to comply with the supplementary code to which the note relates when providing one or more of the digital verification services recorded in the note,
- (c) the Secretary of State is satisfied that the person has failed to provide the Secretary of State with information in accordance with a notice under section [51](https://www.legislation.gov.uk/ukpga/2025/18/section/51/2025-09-30), or
- (c) the Secretary of State is satisfied that the person has failed to provide the Secretary of State with information in accordance with a notice under section [51](https://www.legislation.gov.uk/ukpga/2025/18/section/51/2025-11-17), or
- (d) the Secretary of State considers that it is necessary to do so in the interests of national security.
@@ -1608,25 +1608,25 @@
- (b) state the reason why the Secretary of State—
- (i) is satisfied that the person is failing or has failed as mentioned in [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/1/2025-09-30)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/1/a/2025-09-30) to [(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/1/c/2025-09-30), or
- (i) is satisfied that the person is failing or has failed as mentioned in [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/1/2025-11-17)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/1/a/2025-11-17) to [(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/1/c/2025-11-17), or
- (ii) considers that it is necessary to remove the person from the DVS register in the interests of national security,
- (c) state whether the Secretary of State intends to specify a period in the notice under [subsection (8)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/8/2025-09-30) and, if so, what period is intended to be specified,
- (c) state whether the Secretary of State intends to specify a period in the notice under [subsection (8)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/8/2025-11-17) and, if so, what period is intended to be specified,
- (d) state that the person may make written representations to the Secretary of State about—
- (i) the Secretary of State’s intention to remove the person from the DVS register, and
- (ii) where relevant, the period the Secretary of State intends to specify in the notice under [subsection (8)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/8/2025-09-30), and
- (ii) where relevant, the period the Secretary of State intends to specify in the notice under [subsection (8)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/8/2025-11-17), and
- (e) specify the period within which such representations may be made.
- (4) The requirement in subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/3/2025-09-30)[(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/3/b/2025-09-30) does not apply if, or to the extent that, the Secretary of State considers that stating the reason described in subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/3/2025-09-30)[(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/3/b/2025-09-30)[(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/3/b/ii/2025-09-30) would be contrary to the interests of national security.
- (4) The requirement in subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/3/2025-11-17)[(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/3/b/2025-11-17) does not apply if, or to the extent that, the Secretary of State considers that stating the reason described in subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/3/2025-11-17)[(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/3/b/2025-11-17)[(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/3/b/ii/2025-11-17) would be contrary to the interests of national security.
- (5) The period specified for making written representations must be a period of not less than 21 days beginning with the day on which the notice is given.
- (6) If the Secretary of State considers that it is appropriate for the person to have an opportunity to make oral representations about the matters mentioned in [subsection (3)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/3/2025-09-30)[(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/3/d/2025-09-30), the notice must also—
- (6) If the Secretary of State considers that it is appropriate for the person to have an opportunity to make oral representations about the matters mentioned in [subsection (3)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/3/2025-11-17)[(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/3/d/2025-11-17), the notice must also—
- (a) state that the person may make such representations, and
@@ -1636,17 +1636,17 @@
- (8) Where the Secretary of State removes the person from the DVS register under this section, the Secretary of State must by written notice inform the person of that.
- (9) The Secretary of State may, in the notice given under subsection [(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/8/2025-09-30), state that any application for re-registration made by the person during a period specified in the notice will be refused.
- (10) If the person applies to be re-registered during the period specified in the notice in reliance on subsection [(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/9/2025-09-30), the Secretary of State must refuse the application.
- (11) The period specified in the notice in reliance on subsection [(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/9/2025-09-30) must begin with the day on which the notice is given and must not exceed two years.
- (9) The Secretary of State may, in the notice given under subsection [(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/8/2025-11-17), state that any application for re-registration made by the person during a period specified in the notice will be refused.
- (10) If the person applies to be re-registered during the period specified in the notice in reliance on subsection [(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/9/2025-11-17), the Secretary of State must refuse the application.
- (11) The period specified in the notice in reliance on subsection [(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/41/9/2025-11-17) must begin with the day on which the notice is given and must not exceed two years.
#### Duty to remove services from the DVS register
##### 42
- (1) Where a person is registered in the DVS register in respect of digital verification services, subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/42/2/2025-09-30) applies if the person—
- (1) Where a person is registered in the DVS register in respect of digital verification services, subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/42/2/2025-11-17) applies if the person—
- (a) asks for the register to be amended so that the person is no longer registered in respect of one or more of those services,
@@ -1656,19 +1656,19 @@
- (2) The Secretary of State must amend the register to record that the person is no longer registered in respect of (as the case may be)—
- (a) the service or services mentioned in a request described in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/42/1/2025-09-30)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/42/1/a/2025-09-30),
- (a) the service or services mentioned in a request described in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/42/1/2025-11-17)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/42/1/a/2025-11-17),
- (b) the service or services which the person has ceased to provide, or
- (c) the service or services for which there is no longer a certificate as described in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/42/1/2025-09-30)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/42/1/c/2025-09-30).
- (3) For the purposes of subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/42/1/2025-09-30)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/42/1/c/2025-09-30), a certificate is to be ignored if—
- (c) the service or services for which there is no longer a certificate as described in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/42/1/2025-11-17)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/42/1/c/2025-11-17).
- (3) For the purposes of subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/42/1/2025-11-17)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/42/1/c/2025-11-17), a certificate is to be ignored if—
- (a) it has expired in accordance with its terms,
- (b) it has been withdrawn by the body that issued it, or
- (c) it is required to be ignored by reason of provision included in the DVS trust framework under section [28](https://www.legislation.gov.uk/ukpga/2025/18/section/28/2025-09-30)[(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/28/8/2025-09-30).
- (c) it is required to be ignored by reason of provision included in the DVS trust framework under section [28](https://www.legislation.gov.uk/ukpga/2025/18/section/28/2025-11-17)[(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/28/8/2025-11-17).
#### Duty to remove supplementary notes from the DVS register
@@ -1684,19 +1684,19 @@
- (d) the supplementary code to which the note relates has been withdrawn.
- (2) For the purposes of subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/43/1/2025-09-30)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/43/1/c/2025-09-30), a certificate is to be ignored if—
- (2) For the purposes of subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/43/1/2025-11-17)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/43/1/c/2025-11-17), a certificate is to be ignored if—
- (a) it has expired in accordance with its terms,
- (b) it has been withdrawn by the body that issued it, or
- (c) it is required to be ignored by reason of provision included in the supplementary code as a result of section [29](https://www.legislation.gov.uk/ukpga/2025/18/section/29/2025-09-30)[(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/29/9/2025-09-30).
- (c) it is required to be ignored by reason of provision included in the supplementary code as a result of section [29](https://www.legislation.gov.uk/ukpga/2025/18/section/29/2025-11-17)[(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/29/9/2025-11-17).
#### Duty to remove services from supplementary notes
##### 44
- (1) Where a person has a supplementary note included in their entry in the DVS register in respect of digital verification services, subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/44/2/2025-09-30) applies if the person—
- (1) Where a person has a supplementary note included in their entry in the DVS register in respect of digital verification services, subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/44/2/2025-11-17) applies if the person—
- (a) asks for the note to be amended so that it no longer records one or more of those services,
@@ -1706,19 +1706,19 @@
- (2) The Secretary of State must amend the supplementary note so it no longer records (as the case may be)—
- (a) the service or services mentioned in a request described in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/42/1/2025-09-30)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/42/1/a/2025-09-30),
- (a) the service or services mentioned in a request described in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/42/1/2025-11-17)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/42/1/a/2025-11-17),
- (b) the service or services which the person has ceased to provide, or
- (c) the service or services for which there is no longer a certificate as described in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/42/1/2025-09-30)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/42/1/c/2025-09-30).
- (3) For the purposes of [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/40/1/2025-09-30)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/40/1/c/2025-09-30), a certificate is to be ignored if—
- (c) the service or services for which there is no longer a certificate as described in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/42/1/2025-11-17)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/42/1/c/2025-11-17).
- (3) For the purposes of [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/40/1/2025-11-17)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/40/1/c/2025-11-17), a certificate is to be ignored if—
- (a) it has expired in accordance with its terms,
- (b) it has been withdrawn by the body that issued it, or
- (c) it is required to be ignored by reason of provision included in the supplementary code as a result of section [29](https://www.legislation.gov.uk/ukpga/2025/18/section/29/2025-09-30)[(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/29/9/2025-09-30).
- (c) it is required to be ignored by reason of provision included in the supplementary code as a result of section [29](https://www.legislation.gov.uk/ukpga/2025/18/section/29/2025-11-17)[(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/29/9/2025-11-17).
### Information gateway
@@ -1762,7 +1762,7 @@
##### 46
- (1) This section applies where the Revenue and Customs disclose personal information to a person under [section 45](https://www.legislation.gov.uk/ukpga/2025/18/section/45/2025-09-30) for the purpose of enabling the person to provide digital verification services for an individual.
- (1) This section applies where the Revenue and Customs disclose personal information to a person under [section 45](https://www.legislation.gov.uk/ukpga/2025/18/section/45/2025-11-17) for the purpose of enabling the person to provide digital verification services for an individual.
- (2) The person must not further disclose the information otherwise than for the purpose of providing digital verification services for the individual, except with the consent of the Commissioners for His Majesty’s Revenue and Customs.
@@ -1780,21 +1780,21 @@
##### 47
- (1) This section applies where the Welsh Revenue Authority discloses personal information to a person under section [45](https://www.legislation.gov.uk/ukpga/2025/18/section/45/2025-09-30) for the purpose of enabling the person to provide digital verification services for an individual.
- (1) This section applies where the Welsh Revenue Authority discloses personal information to a person under section [45](https://www.legislation.gov.uk/ukpga/2025/18/section/45/2025-11-17) for the purpose of enabling the person to provide digital verification services for an individual.
- (2) The person must not further disclose the information otherwise than for the purpose of providing digital verification services for the individual, except with the consent of the Welsh Revenue Authority.
- (3) Any other person who receives the information, whether directly or indirectly from the person to whom the Welsh Revenue Authority discloses the information, must not further disclose the information, except with the consent of the Welsh Revenue Authority.
- (4) A person who discloses information in contravention of subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/47/2/2025-09-30) or [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/47/3/2025-09-30) commits an offence.
- (5) It is a defence for a person charged with an offence under subsection [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/47/4/2025-09-30) to prove that the person reasonably believed—
- (4) A person who discloses information in contravention of subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/47/2/2025-11-17) or [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/47/3/2025-11-17) commits an offence.
- (5) It is a defence for a person charged with an offence under subsection [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/47/4/2025-11-17) to prove that the person reasonably believed—
- (a) that the disclosure was lawful, or
- (b) that the information had already lawfully been made available to the public.
- (6) A person who commits an offence under subsection [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/47/4/2025-09-30) is liable—
- (6) A person who commits an offence under subsection [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/47/4/2025-11-17) is liable—
- (a) on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);
@@ -1814,21 +1814,21 @@
##### 48
- (1) This section applies where Revenue Scotland discloses personal information to a person under section [45](https://www.legislation.gov.uk/ukpga/2025/18/section/45/2025-09-30) for the purpose of enabling the person to provide digital verification services for an individual.
- (1) This section applies where Revenue Scotland discloses personal information to a person under section [45](https://www.legislation.gov.uk/ukpga/2025/18/section/45/2025-11-17) for the purpose of enabling the person to provide digital verification services for an individual.
- (2) The person must not further disclose the information otherwise than for the purpose of providing digital verification services for the individual, except with the consent of Revenue Scotland.
- (3) Any other person who receives the information, whether directly or indirectly from the person to whom Revenue Scotland discloses the information, must not further disclose the information, except with the consent of Revenue Scotland.
- (4) A person who discloses information in contravention of subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/48/2/2025-09-30) or [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/48/3/2025-09-30) commits an offence.
- (5) It is a defence for a person charged with an offence under subsection [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/48/4/2025-09-30) to prove that the person reasonably believed—
- (4) A person who discloses information in contravention of subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/48/2/2025-11-17) or [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/48/3/2025-11-17) commits an offence.
- (5) It is a defence for a person charged with an offence under subsection [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/48/4/2025-11-17) to prove that the person reasonably believed—
- (a) that the disclosure was lawful, or
- (b) that the information had already lawfully been made available to the public.
- (6) A person who commits an offence under subsection [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/48/4/2025-09-30) is liable—
- (6) A person who commits an offence under subsection [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/48/4/2025-11-17) is liable—
- (a) on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);
@@ -1848,11 +1848,11 @@
##### 49
- (1) The Secretary of State must prepare and publish a code of practice about the disclosure of information under section [45](https://www.legislation.gov.uk/ukpga/2025/18/section/45/2025-09-30).
- (1) The Secretary of State must prepare and publish a code of practice about the disclosure of information under section [45](https://www.legislation.gov.uk/ukpga/2025/18/section/45/2025-11-17).
- (2) The code of practice must be consistent with the code of practice prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act (as altered or replaced from time to time).
- (3) A public authority must have regard to the code of practice in disclosing information under section [45](https://www.legislation.gov.uk/ukpga/2025/18/section/45/2025-09-30).
- (3) A public authority must have regard to the code of practice in disclosing information under section [45](https://www.legislation.gov.uk/ukpga/2025/18/section/45/2025-11-17).
- (4) The Secretary of State may from time to time revise and republish the code of practice.
@@ -1868,7 +1868,7 @@
- (e) such other persons as the Secretary of State considers appropriate.
- (6) The requirement in [subsection (5)](https://www.legislation.gov.uk/ukpga/2025/18/section/49/5/2025-09-30) may be satisfied by consultation undertaken before the coming into force of this section.
- (6) The requirement in [subsection (5)](https://www.legislation.gov.uk/ukpga/2025/18/section/49/5/2025-11-17) may be satisfied by consultation undertaken before the coming into force of this section.
- (7) The Secretary of State may not publish the first version of the code of practice unless a draft of the code has been laid before, and approved by a resolution of, each House of Parliament.
@@ -1904,7 +1904,7 @@
- (3) A mark designated under this section may not be used by a person in the course of providing, or offering to provide, digital verification services unless the person is registered in the DVS register in respect of those digital verification services.
- (4) The Secretary of State may enforce [subsection (3)](https://www.legislation.gov.uk/ukpga/2025/18/section/50/3/2025-09-30) in civil proceedings for an injunction or, in Scotland, an interdict.
- (4) The Secretary of State may enforce [subsection (3)](https://www.legislation.gov.uk/ukpga/2025/18/section/50/3/2025-11-17) in civil proceedings for an injunction or, in Scotland, an interdict.
### Supplementary
@@ -1932,7 +1932,7 @@
- (d) may specify the place where the information must be provided.
- (4) A notice under this section that is given to a person registered in the DVS register must provide information about the consequences under [section 41](https://www.legislation.gov.uk/ukpga/2025/18/section/41/2025-09-30) of failure to comply with the notice.
- (4) A notice under this section that is given to a person registered in the DVS register must provide information about the consequences under [section 41](https://www.legislation.gov.uk/ukpga/2025/18/section/41/2025-11-17) of failure to comply with the notice.
- (5) The Secretary of State may cancel a notice under this section by notice to the person to whom it was given.
@@ -1944,7 +1944,7 @@
- (7) But a notice under this section does not require a disclosure of information if the disclosure—
- (a) would contravene [section 46](https://www.legislation.gov.uk/ukpga/2025/18/section/46/2025-09-30), [47](https://www.legislation.gov.uk/ukpga/2025/18/section/47/2025-09-30) or [48](https://www.legislation.gov.uk/ukpga/2025/18/section/48/2025-09-30),
- (a) would contravene [section 46](https://www.legislation.gov.uk/ukpga/2025/18/section/46/2025-11-17), [47](https://www.legislation.gov.uk/ukpga/2025/18/section/47/2025-11-17) or [48](https://www.legislation.gov.uk/ukpga/2025/18/section/48/2025-11-17),
- (b) would contravene the data protection legislation (but in determining whether a disclosure would do so, the duty imposed by the notice is to be taken into account), or
@@ -1956,11 +1956,11 @@
- (b) in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under this Part.
- (9) In [subsection (8)](https://www.legislation.gov.uk/ukpga/2025/18/section/51/8/2025-09-30), references to the client of a professional legal adviser include references to a person acting on behalf of the client.
- (9) In [subsection (8)](https://www.legislation.gov.uk/ukpga/2025/18/section/51/8/2025-11-17), references to the client of a professional legal adviser include references to a person acting on behalf of the client.
- (10) A notice under this section does not require a person to provide the Secretary of State with information if doing so would, by revealing evidence of the commission of an offence, expose the person to proceedings for that offence.
- (11) The reference to an offence in [subsection (10)](https://www.legislation.gov.uk/ukpga/2025/18/section/51/10/2025-09-30) does not include an offence under—
- (11) The reference to an offence in [subsection (10)](https://www.legislation.gov.uk/ukpga/2025/18/section/51/10/2025-11-17) does not include an offence under—
- (a) section 5 of the Perjury Act 1911 (false statements made otherwise than on oath);
@@ -1984,7 +1984,7 @@
- (3) Regulations under this section are subject to the affirmative resolution procedure.
- (4) In this section, “*relevant function*” means a function of the Secretary of State conferred by or under this Part (including the function of charging or recovering fees under regulations under section [39](https://www.legislation.gov.uk/ukpga/2025/18/section/39/2025-09-30)) other than a power to make regulations.
- (4) In this section, “*relevant function*” means a function of the Secretary of State conferred by or under this Part (including the function of charging or recovering fees under regulations under section [39](https://www.legislation.gov.uk/ukpga/2025/18/section/39/2025-11-17)) other than a power to make regulations.
- (5) If a person exercises the function of charging or recovering fees by virtue of arrangements under this section, the person must pay the fees to the Secretary of State, except to the extent that the Secretary of State directs otherwise.
@@ -1994,7 +1994,7 @@
- (1) The Secretary of State must prepare and publish reports on the operation of this Part.
- (2) The first report must be published within the period of 12 months beginning with the day on which [section 28](https://www.legislation.gov.uk/ukpga/2025/18/section/28/2025-09-30) comes into force.
- (2) The first report must be published within the period of 12 months beginning with the day on which [section 28](https://www.legislation.gov.uk/ukpga/2025/18/section/28/2025-11-17) comes into force.
- (3) The reports must be published not more than 12 months apart.
@@ -2006,12 +2006,12 @@
| *Term* | *Provision* |
| --- | --- |
| accredited conformity assessment body | section [33](https://www.legislation.gov.uk/ukpga/2025/18/section/33/2025-09-30) [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/33/6/2025-09-30) |
| digital verification services | section [27](https://www.legislation.gov.uk/ukpga/2025/18/section/27/2025-09-30) [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/27/2/2025-09-30) |
| the DVS register | section [32](https://www.legislation.gov.uk/ukpga/2025/18/section/32/2025-09-30) [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/32/2/2025-09-30) |
| the DVS trust framework | section [28](https://www.legislation.gov.uk/ukpga/2025/18/section/28/2025-09-30) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/28/1/2025-09-30) |
| supplementary code | section [29](https://www.legislation.gov.uk/ukpga/2025/18/section/29/2025-09-30) [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/29/2/2025-09-30) |
| supplementary note | section [36](https://www.legislation.gov.uk/ukpga/2025/18/section/36/2025-09-30) [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/36/6/2025-09-30) |
| accredited conformity assessment body | section [33](https://www.legislation.gov.uk/ukpga/2025/18/section/33/2025-11-17) [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/33/6/2025-11-17) |
| digital verification services | section [27](https://www.legislation.gov.uk/ukpga/2025/18/section/27/2025-11-17) [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/27/2/2025-11-17) |
| the DVS register | section [32](https://www.legislation.gov.uk/ukpga/2025/18/section/32/2025-11-17) [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/32/2/2025-11-17) |
| the DVS trust framework | section [28](https://www.legislation.gov.uk/ukpga/2025/18/section/28/2025-11-17) [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/28/1/2025-11-17) |
| supplementary code | section [29](https://www.legislation.gov.uk/ukpga/2025/18/section/29/2025-11-17) [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/29/2/2025-11-17) |
| supplementary note | section [36](https://www.legislation.gov.uk/ukpga/2025/18/section/36/2025-11-17) [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/36/6/2025-11-17) |
#### Powers relating to verification of identity or status
@@ -2024,7 +2024,7 @@
> (b) specify a document which was provided to such a person in order to generate such a document;
> (c) specify steps involving the use of services provided by such a person.
> (9) In subsection (8), “*DVS-registered person*” means a person who is registered in the DVS register maintained under Part 2 of the Data (Use and Access) Act 2025 (“*the DVS register*”).
> (10) An order under subsection (3) which specifies a description of DVS-registered person may do so by, for example, describing a DVS-registered person whose entry in the DVS register includes a note relating to specified services (see section [36](https://www.legislation.gov.uk/ukpga/2025/18/section/36/2025-09-30) of the Data (Use and Access) Act 2025).
> (10) An order under subsection (3) which specifies a description of DVS-registered person may do so by, for example, describing a DVS-registered person whose entry in the DVS register includes a note relating to specified services (see section [36](https://www.legislation.gov.uk/ukpga/2025/18/section/36/2025-11-17) of the Data (Use and Access) Act 2025).
- (2) In section 34 of the Immigration Act 2014 (requirements which may be prescribed for the purposes of provisions about occupying premises under a residential tenancy agreement)—
@@ -2042,7 +2042,7 @@
> (a) prescribe a document generated by a DVS-registered person or a DVS-registered person of a prescribed description;
> (b) prescribe a document which was provided to such a person in order to generate such a document.
> (1B) In subsections (1) and (1A), “*DVS-registered person*” means a person who is registered in the DVS register maintained under Part 2 of the Data (Use and Access) Act 2025 (“*the DVS register*”).
> (1C) An order prescribing requirements for the purposes of this Chapter which prescribes a description of DVS-registered person may do so by, for example, describing a DVS-registered person whose entry in the DVS register includes a note relating to prescribed services (see section [36](https://www.legislation.gov.uk/ukpga/2025/18/section/36/2025-09-30) of the Data (Use and Access) Act 2025).
> (1C) An order prescribing requirements for the purposes of this Chapter which prescribes a description of DVS-registered person may do so by, for example, describing a DVS-registered person whose entry in the DVS register includes a note relating to prescribed services (see section [36](https://www.legislation.gov.uk/ukpga/2025/18/section/36/2025-11-17) of the Data (Use and Access) Act 2025).
- (3) In Schedule 6 to the Immigration Act 2016 (illegal working compliance orders etc), after paragraph 5 insert—
@@ -2052,7 +2052,7 @@
> (b) prescribe documents generated by such a person;
> (c) prescribe documents which were provided to such a person in order to generate such documents.
> (2) In sub-paragraph (1), “*DVS-registered person*” means a person who is registered in the DVS register maintained under Part 2 of the Data (Use and Access) Act 2025 (“*the DVS register*”).
> (3) Regulations under paragraph 5(6)(b) or (c) which prescribe a description of DVS-registered person may do so by, for example, describing a DVS-registered person whose entry in the DVS register includes a note relating to prescribed services (see section [36](https://www.legislation.gov.uk/ukpga/2025/18/section/36/2025-09-30) of the Data (Use and Access) Act 2025).
> (3) Regulations under paragraph 5(6)(b) or (c) which prescribe a description of DVS-registered person may do so by, for example, describing a DVS-registered person whose entry in the DVS register includes a note relating to prescribed services (see section [36](https://www.legislation.gov.uk/ukpga/2025/18/section/36/2025-11-17) of the Data (Use and Access) Act 2025).
## Part 3 — National Underground Asset Register
@@ -2193,20 +2193,20 @@
> - “*undertaker*” (in relation to apparatus or in a context referring to having apparatus in a street) (see sections 48(5) and 89(4)).
> (2) In this Part “*processing*” has the same meaning as in the Data Protection Act 2018 (see section 3(4) of that Act) and “process” is to be read accordingly.
- (2) Section 166 of the New Roads and Street Works Act 1991, so far as relating to Part 3A of that Act (inserted by [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/56/1/2025-09-30)), extends to England and Wales.
- (2) Section 166 of the New Roads and Street Works Act 1991, so far as relating to Part 3A of that Act (inserted by [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/56/1/2025-11-17)), extends to England and Wales.
- (3) In section 167 of that Act (Crown application), after subsection (5) insert—
> (5A) The provisions of Part [3A](#p05422) of this Act (National Underground Asset Register: England and Wales) bind the Crown.
> (5B) Nothing in [subsection (5A)](#p06028) is to be construed as authorising the bringing of proceedings for a criminal offence against a person acting on behalf of the Crown.
- (4) Schedule [1](https://www.legislation.gov.uk/ukpga/2025/18/schedule/1/2025-09-30) to this Act inserts [Schedule 5A](#p16926) into the New Roads and Street Works Act 1991 (monetary penalties).
- (4) Schedule [1](https://www.legislation.gov.uk/ukpga/2025/18/schedule/1/2025-11-17) to this Act inserts [Schedule 5A](#p16926) into the New Roads and Street Works Act 1991 (monetary penalties).
#### Information in relation to apparatus: England and Wales
##### 57
- (1) The New Roads and Street Works Act 1991 is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/57/2/2025-09-30) to [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/57/6/2025-09-30).
- (1) The New Roads and Street Works Act 1991 is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/57/2/2025-11-17) to [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/57/6/2025-11-17).
- (2) For the italic heading before section 79 (records of location of apparatus) substitute “Duties in relation to recording and sharing of information about apparatus”.
@@ -2301,7 +2301,7 @@
> (2A) Regulations made by the Welsh Ministers under section 79 are to be made by statutory instrument and a statutory instrument containing such regulations is subject to annulment in pursuance of a resolution of Senedd Cymru.
- (7) In consequence of the provision made by [subsection (4)](https://www.legislation.gov.uk/ukpga/2025/18/section/57/4/2025-09-30), omit section 47 of the Traffic Management Act 2004.
- (7) In consequence of the provision made by [subsection (4)](https://www.legislation.gov.uk/ukpga/2025/18/section/57/4/2025-11-17), omit section 47 of the Traffic Management Act 2004.
- (8) In Schedule 7B to the Government of Wales Act 2006 (general restriction on competence of Senedd Cymru), in paragraph 11(6)(b) (exceptions to restrictions relating to Ministers of the Crown), before sub-paragraph (i) insert—
@@ -2313,7 +2313,7 @@
##### 58
- (1) The Street Works (Northern Ireland) Order 1995 ([S.I. 1995/3210 (N.I. 19))](https://www.legislation.gov.uk/nisi/1995/3210) is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/58/2/2025-09-30) to [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/58/4/2025-09-30).
- (1) The Street Works (Northern Ireland) Order 1995 ([S.I. 1995/3210 (N.I. 19))](https://www.legislation.gov.uk/nisi/1995/3210) is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/58/2/2025-11-17) to [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/58/4/2025-11-17).
- (2) In Article 2 (interpretation), in paragraph (2)—
@@ -2470,15 +2470,15 @@
> (1H) Where regulations under this Order are subject to “the negative Westminster procedure” the statutory instrument containing the regulations is subject to annulment in pursuance of a resolution of either House of Parliament.
> (1I) Any provision that may be made in regulations under this Order subject to the negative Westminster procedure may be made in regulations subject to the affirmative Westminster procedure.
- (5) Article 59[(A2)](#p06881) of the Street Works (Northern Ireland) Order 1995 ([S.I. 1995/3210 (N.I. 19))](https://www.legislation.gov.uk/nisi/1995/3210) (inserted by subsection [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/58/4/2025-09-30)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/58/4/a/2025-09-30)) is revoked on the coming into operation of Article 59(1A) of that Order (as inserted by Article 28(3) of the Street Works (Amendment) (Northern Ireland) Order 2007 ([S.I. 2007/287 (N.I. 1)))](https://www.legislation.gov.uk/nisi/2007/287).
- (6) Schedule [2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/2/2025-09-30) to this Act inserts Schedule [2ZA](#p17198) into the Street Works (Northern Ireland) Order 1995 ([S.I. 1995/3210 (N.I. 19))](https://www.legislation.gov.uk/nisi/1995/3210) (monetary penalties).
- (5) Article 59[(A2)](#p06881) of the Street Works (Northern Ireland) Order 1995 ([S.I. 1995/3210 (N.I. 19))](https://www.legislation.gov.uk/nisi/1995/3210) (inserted by subsection [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/58/4/2025-11-17)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/58/4/a/2025-11-17)) is revoked on the coming into operation of Article 59(1A) of that Order (as inserted by Article 28(3) of the Street Works (Amendment) (Northern Ireland) Order 2007 ([S.I. 2007/287 (N.I. 1)))](https://www.legislation.gov.uk/nisi/2007/287).
- (6) Schedule [2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/2/2025-11-17) to this Act inserts Schedule [2ZA](#p17198) into the Street Works (Northern Ireland) Order 1995 ([S.I. 1995/3210 (N.I. 19))](https://www.legislation.gov.uk/nisi/1995/3210) (monetary penalties).
#### Information in relation to apparatus: Northern Ireland
##### 59
- (1) The Street Works (Northern Ireland) Order 1995 ([S.I. 1995/3210 (N.I. 19))](https://www.legislation.gov.uk/nisi/1995/3210) is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/59/2/2025-09-30)to [(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/59/5/2025-09-30).
- (1) The Street Works (Northern Ireland) Order 1995 ([S.I. 1995/3210 (N.I. 19))](https://www.legislation.gov.uk/nisi/1995/3210) is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/59/2/2025-11-17)to [(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/59/5/2025-11-17).
- (2) For the italic heading before Article 39 (records of location of apparatus) substitute “Duties in relation to recording and sharing of information about apparatus”.
@@ -2545,17 +2545,17 @@
.
- (6) As a consequence of the provision made by [subsection (4)](https://www.legislation.gov.uk/ukpga/2025/18/section/59/4/2025-09-30), omit Article 23 of the Street Works (Amendment) (Northern Ireland) Order 2007 ([S.I. 2007/287 (N.I. 1))](https://www.legislation.gov.uk/nisi/2007/287).
- (7) A power of the Secretary of State to make regulations under paragraph (1) or (2) of Article 39 of the Street Works (Northern Ireland) Order 1995 ([S.I. 1995/3210 (N.I. 19))](https://www.legislation.gov.uk/nisi/1995/3210) (by virtue of subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/59/3/2025-09-30)[(g)](https://www.legislation.gov.uk/ukpga/2025/18/section/59/3/g/2025-09-30)) includes power to amend or revoke any provision of the Street Works (Records) Regulations (Northern Ireland) 2004 (S.R. [(N.I.) 2004 No. 276](https://www.legislation.gov.uk/nisr/2004/276)) made under the paragraph concerned.
- (6) As a consequence of the provision made by [subsection (4)](https://www.legislation.gov.uk/ukpga/2025/18/section/59/4/2025-11-17), omit Article 23 of the Street Works (Amendment) (Northern Ireland) Order 2007 ([S.I. 2007/287 (N.I. 1))](https://www.legislation.gov.uk/nisi/2007/287).
- (7) A power of the Secretary of State to make regulations under paragraph (1) or (2) of Article 39 of the Street Works (Northern Ireland) Order 1995 ([S.I. 1995/3210 (N.I. 19))](https://www.legislation.gov.uk/nisi/1995/3210) (by virtue of subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/59/3/2025-11-17)[(g)](https://www.legislation.gov.uk/ukpga/2025/18/section/59/3/g/2025-11-17)) includes power to amend or revoke any provision of the Street Works (Records) Regulations (Northern Ireland) 2004 (S.R. [(N.I.) 2004 No. 276](https://www.legislation.gov.uk/nisr/2004/276)) made under the paragraph concerned.
#### Pre-commencement consultation
##### 60
- (1) A requirement to consult under a provision inserted into the New Roads and Street Works Act 1991 by section [56](https://www.legislation.gov.uk/ukpga/2025/18/section/56/2025-09-30) or [57](https://www.legislation.gov.uk/ukpga/2025/18/section/57/2025-09-30) may be satisfied by consultation undertaken before the day on which this Act is passed.
- (2) A requirement to consult under a provision inserted into the Street Works (Northern Ireland) Order 1995 ([S.I. 1995/3210 (N.I. 19))](https://www.legislation.gov.uk/nisi/1995/3210) by section [58](https://www.legislation.gov.uk/ukpga/2025/18/section/58/2025-09-30) or [59](https://www.legislation.gov.uk/ukpga/2025/18/section/59/2025-09-30) may be satisfied by consultation undertaken before the day on which this Act is passed.
- (1) A requirement to consult under a provision inserted into the New Roads and Street Works Act 1991 by section [56](https://www.legislation.gov.uk/ukpga/2025/18/section/56/2025-11-17) or [57](https://www.legislation.gov.uk/ukpga/2025/18/section/57/2025-11-17) may be satisfied by consultation undertaken before the day on which this Act is passed.
- (2) A requirement to consult under a provision inserted into the Street Works (Northern Ireland) Order 1995 ([S.I. 1995/3210 (N.I. 19))](https://www.legislation.gov.uk/nisi/1995/3210) by section [58](https://www.legislation.gov.uk/ukpga/2025/18/section/58/2025-11-17) or [59](https://www.legislation.gov.uk/ukpga/2025/18/section/59/2025-11-17) may be satisfied by consultation undertaken before the day on which this Act is passed.
## Part 4 — Registers of births and deaths
@@ -2622,7 +2622,7 @@
##### 64
- (1) The repeal of section 28 of the Births and Deaths Registration Act 1953 by [section 61](https://www.legislation.gov.uk/ukpga/2025/18/section/61/2025-09-30) above does not affect—
- (1) The repeal of section 28 of the Births and Deaths Registration Act 1953 by [section 61](https://www.legislation.gov.uk/ukpga/2025/18/section/61/2025-11-17) above does not affect—
- (a) the requirement under section 28(2) of that Act for every superintendent registrar (“*S*”) to keep with the records of S’s office any registers of live-births or of deaths which are in S’s custody immediately before the coming into force of that repeal, or
@@ -2638,13 +2638,13 @@
- (4) The Registrar General may dispose of—
- (a) any certified copies held by the Registrar General of entries in any register of still-births forwarded to the Registrar General under section 28(3) of the Births and Deaths Registration Act 1953 or [subsection (3)](https://www.legislation.gov.uk/ukpga/2025/18/section/64/3/2025-09-30) above, or
- (a) any certified copies held by the Registrar General of entries in any register of still-births forwarded to the Registrar General under section 28(3) of the Births and Deaths Registration Act 1953 or [subsection (3)](https://www.legislation.gov.uk/ukpga/2025/18/section/64/3/2025-11-17) above, or
- (b) any information contained in those entries which is held by the Registrar General in electronic form by virtue of section 27 of that Act.
- (5) Where, at any time during the period mentioned in [subsection (6)](https://www.legislation.gov.uk/ukpga/2025/18/section/64/6/2025-09-30), a copy has been kept otherwise than in hard copy form of any register of births or register of deaths kept for a sub-district under the Births and Deaths Registration Act 1953—
- (a) that copy is to be treated, on and after the day on which [section 61](https://www.legislation.gov.uk/ukpga/2025/18/section/61/2025-09-30) of this Act comes into force, as the register kept for the sub-district for the purposes of that Act,
- (5) Where, at any time during the period mentioned in [subsection (6)](https://www.legislation.gov.uk/ukpga/2025/18/section/64/6/2025-11-17), a copy has been kept otherwise than in hard copy form of any register of births or register of deaths kept for a sub-district under the Births and Deaths Registration Act 1953—
- (a) that copy is to be treated, on and after the day on which [section 61](https://www.legislation.gov.uk/ukpga/2025/18/section/61/2025-11-17) of this Act comes into force, as the register kept for the sub-district for the purposes of that Act,
- (b) on and after that day, the register is to be treated for the purposes of section 25(3) of that Act as having been kept in the form in which the copy was kept,
@@ -2656,11 +2656,11 @@
- (ii) any information contained in those entries which is held by the Registrar General in electronic form by virtue of section 27 of that Act.
- (6) The period referred to in [subsection (5)](https://www.legislation.gov.uk/ukpga/2025/18/section/64/5/2025-09-30) is the period—
- (6) The period referred to in [subsection (5)](https://www.legislation.gov.uk/ukpga/2025/18/section/64/5/2025-11-17) is the period—
- (a) beginning with 1 July 2009, and
- (b) ending immediately before the day on which [section 61](https://www.legislation.gov.uk/ukpga/2025/18/section/61/2025-09-30) comes into force.
- (b) ending immediately before the day on which [section 61](https://www.legislation.gov.uk/ukpga/2025/18/section/61/2025-11-17) comes into force.
- (7) Expressions used in this section and in the Births and Deaths Registration Act 1953 have the same meaning in this section as in that Act.
@@ -2668,7 +2668,7 @@
##### 65
[Schedule 3](https://www.legislation.gov.uk/ukpga/2025/18/schedule/3/2025-09-30) contains minor and consequential amendments.
[Schedule 3](https://www.legislation.gov.uk/ukpga/2025/18/schedule/3/2025-11-17) contains minor and consequential amendments.
## Part 5 — Data protection and privacy
@@ -2707,7 +2707,7 @@
> (a) the information that results from the processing is aggregate data that is not personal data, and
> (b) the controller does not use the personal data processed, or the information that results from the processing, in support of measures or decisions with respect to a particular data subject to whom the personal data relates.
- (2) In consequence of the amendment made by subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/67/1/2025-09-30)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/67/1/a/2025-09-30), in section 6 of the 2018 Act (meaning of “*controller*”), for “4(7)” substitute “4(1)(7)”.
- (2) In consequence of the amendment made by subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/67/1/2025-11-17)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/67/1/a/2025-11-17), in section 6 of the 2018 Act (meaning of “*controller*”), for “4(7)” substitute “4(1)(7)”.
#### Consent to processing for the purposes of scientific research
@@ -2717,7 +2717,7 @@
- (2) In point (11) of paragraph 1 (definition of “consent”), at the end insert “(and see paragraphs 6 and 7 of this Article)”.
- (3) After paragraph 5 (inserted by [section 67](https://www.legislation.gov.uk/ukpga/2025/18/section/67/2025-09-30) of this Act) insert—
- (3) After paragraph 5 (inserted by [section 67](https://www.legislation.gov.uk/ukpga/2025/18/section/67/2025-11-17) of this Act) insert—
> (6) A data subject’s consent is to be treated as falling within the definition of “consent” in point (11) of paragraph 1 if—
> (a) it does not fall within that definition because (and only because) the consent is given to the processing of personal data for the purposes of an area of scientific research,
@@ -2772,7 +2772,7 @@
##### 70
- (1) The UK GDPR is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/70/2/2025-09-30) to [(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/70/5/2025-09-30).
- (1) The UK GDPR is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/70/2/2025-11-17) to [(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/70/5/2025-11-17).
- (2) In Article 6(1) (lawful processing)—
@@ -2820,11 +2820,11 @@
- (5) In Article 21(1) (right to object), after “point (e)” insert “, (ea)”.
- (6) [Schedule 4](https://www.legislation.gov.uk/ukpga/2025/18/schedule/4/2025-09-30) to this Act inserts Annex 1 to the UK GDPR.
- (6) [Schedule 4](https://www.legislation.gov.uk/ukpga/2025/18/schedule/4/2025-11-17) to this Act inserts Annex 1 to the UK GDPR.
- (7) In section 8 of the 2018 Act (lawfulness of processing: public interest etc), omit “the controller’s”.
- (8) In the provisions listed in subsection [(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/70/9/2025-09-30)—
- (8) In the provisions listed in subsection [(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/70/9/2025-11-17)—
- (a) for “gateway” substitute “gateways”, and
@@ -2852,7 +2852,7 @@
##### 71
- (1) The UK GDPR is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/71/2/2025-09-30) to [(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/71/5/2025-09-30).
- (1) The UK GDPR is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/71/2/2025-11-17) to [(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/71/5/2025-11-17).
- (2) In Article 5(1)(b) (purpose limitation)—
@@ -2897,9 +2897,9 @@
> (7) Regulations under paragraph 5 may make provision identifying processing by any means, including by reference to the controller, the data subject, the personal data or the provision of Article 6(1) relied on for the purposes of the processing.
> (8) Regulations under paragraph 5 are subject to the affirmative resolution procedure.
- (6) [Schedule 5](https://www.legislation.gov.uk/ukpga/2025/18/schedule/5/2025-09-30) to this Act inserts Annex 2 to the UK GDPR.
- (7) The 2018 Act is amended in accordance with subsections [(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/71/8/2025-09-30) to [(10)](https://www.legislation.gov.uk/ukpga/2025/18/section/71/10/2025-09-30).
- (6) [Schedule 5](https://www.legislation.gov.uk/ukpga/2025/18/schedule/5/2025-11-17) to this Act inserts Annex 2 to the UK GDPR.
- (7) The 2018 Act is amended in accordance with subsections [(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/71/8/2025-11-17) to [(10)](https://www.legislation.gov.uk/ukpga/2025/18/section/71/10/2025-11-17).
- (8) In section 36(1) (the second data protection principle)—
@@ -2927,7 +2927,7 @@
##### 72
- (1) The UK GDPR is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/72/2/2025-09-30) to [(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/72/5/2025-09-30).
- (1) The UK GDPR is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/72/2/2025-11-17) to [(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/72/5/2025-11-17).
- (2) In Article 6(3) (lawfulness of processing: basis in domestic law)—
@@ -2941,7 +2941,7 @@
- (c) in the last subparagraph, in the last sentence, after “domestic law” insert “or relevant international law”.
- (3) In Article 8A(3)(e) (purpose limitation: further processing necessary to safeguard an objective listed in Article 23(1)) (inserted by section [71](https://www.legislation.gov.uk/ukpga/2025/18/section/71/2025-09-30) of this Act), at the end insert “or by relevant international law (see section [9A](#p08160) of the 2018 Act)”.
- (3) In Article 8A(3)(e) (purpose limitation: further processing necessary to safeguard an objective listed in Article 23(1)) (inserted by section [71](https://www.legislation.gov.uk/ukpga/2025/18/section/71/2025-11-17) of this Act), at the end insert “or by relevant international law (see section [9A](#p08160) of the 2018 Act)”.
- (4) In Article 9 (processing of special categories of personal data)—
@@ -2963,7 +2963,7 @@
.
- (6) The 2018 Act is amended in accordance with subsections [(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/72/7/2025-09-30) and [(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/72/8/2025-09-30).
- (6) The 2018 Act is amended in accordance with subsections [(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/72/7/2025-11-17) and [(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/72/8/2025-11-17).
- (7) Before section 10 (and the italic heading before that section) insert—
@@ -3007,7 +3007,7 @@
> (3) Regulations made under this Article (in reliance on Article 91A(4)(b)) may amend section 5, 205 or 206 of the 2018 Act (interpretation).
> (4) Regulations under this Article are subject to the affirmative resolution procedure.
- (2) The 2018 Act is amended in accordance with subsections [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/3/2025-09-30) to [(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/9/2025-09-30).
- (2) The 2018 Act is amended in accordance with subsections [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/3/2025-11-17) to [(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/9/2025-11-17).
- (3) In section 33 (definitions of expressions used in Part 3), after subsection (6) insert—
@@ -3062,7 +3062,7 @@
| “sensitive processing (in Parts 3 and 4) | sections 35 and 86”. |
| --- | --- |
- (10) The Investigatory Powers Act 2016 is amended in accordance with subsections [(11)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/11/2025-09-30) to [(13)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/13/2025-09-30).
- (10) The Investigatory Powers Act 2016 is amended in accordance with subsections [(11)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/11/2025-11-17) to [(13)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/13/2025-11-17).
- (11) In section 202(4) (restrictions on use of class BPD warrants: definitions), omit the definition of “sensitive personal data” and insert—
@@ -3121,7 +3121,7 @@
##### 76
- (1) The UK GDPR is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/76/2/2025-09-30) and [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/76/3/2025-09-30).
- (1) The UK GDPR is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/76/2/2025-11-17) and [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/76/3/2025-11-17).
- (2) In Article 12 (transparent information, communication and modalities for the exercise of rights of the data subject)—
@@ -3168,7 +3168,7 @@
> (ii) the period described in paragraph 4(a).
> (6) An example of a case in which a controller may reasonably require further information is where the controller processes a large amount of information concerning the data subject.
- (4) The 2018 Act is amended in accordance with subsections [(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/76/5/2025-09-30) to [(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/76/7/2025-09-30).
- (4) The 2018 Act is amended in accordance with subsections [(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/76/5/2025-11-17) to [(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/76/7/2025-11-17).
- (5) In section 45(5) (right of access by the data subject), after “delay” insert “and in any event before the end of the applicable time period (as to which see section 54)”.
@@ -3274,7 +3274,7 @@
- (b) in paragraph 3, after “processing” insert “to which the data subject is entitled under paragraph 1”.
- (2) The 2018 Act is amended in accordance with subsections [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/78/3/2025-09-30) and [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/78/4/2025-09-30).
- (2) The 2018 Act is amended in accordance with subsections [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/78/3/2025-11-17) and [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/78/4/2025-11-17).
- (3) In section 45 (law enforcement processing: right of access by the data subject), after subsection (2) insert—
@@ -3318,7 +3318,7 @@
> (c) the data subject’s right to make a request to the Commissioner under section 51,
> (d) the data subject’s right to lodge a complaint with the Commissioner under section 165, and
> (e) the data subject’s right to apply to a court under section 167.
> (3) Subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/2/2025-09-30)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/2/a/2025-09-30) and [(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/2/b/2025-09-30) do not apply to the extent that complying with them would—
> (3) Subsection [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/2/2025-11-17)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/2/a/2025-11-17) and [(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/2/b/2025-11-17) do not apply to the extent that complying with them would—
> (a) undermine a claim described in subsection [(1)](#p09066)[(a)](#p09069), or
> (b) conflict with a duty described in subsection [(1)](#p09066)[(b)](#p09073).
> (4) The controller must—
@@ -3392,7 +3392,7 @@
> (4) Regulations under paragraph 3 may not amend Article 22C.
> (5) Regulations under this Article are subject to the affirmative resolution procedure.
- (2) The 2018 Act is amended in accordance with subsections [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/80/3/2025-09-30) to [(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/80/5/2025-09-30).
- (2) The 2018 Act is amended in accordance with subsections [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/80/3/2025-11-17) to [(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/80/5/2025-11-17).
- (3) For sections 49 and 50 (law enforcement processing: automated individual decision-making) substitute—
@@ -3456,7 +3456,7 @@
- (c) omit subsection (6).
- (6) [Schedule 6](https://www.legislation.gov.uk/ukpga/2025/18/schedule/6/2025-09-30) to this Act contains minor and consequential amendments.
- (6) [Schedule 6](https://www.legislation.gov.uk/ukpga/2025/18/schedule/6/2025-11-17) to this Act contains minor and consequential amendments.
### Obligations of controllers
@@ -3560,15 +3560,15 @@
##### 85
- (1) [Schedule 7](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/2025-09-30) amends Chapter 5 of the UK GDPR (general processing and transfers of personal data to third countries and international organisations).
- (2) [Schedule 8](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/2025-09-30) amends Chapter 5 of Part 3 of the 2018 Act (law enforcement processing and transfers of personal data to third countries and international organisations).
- (3) In Schedule [9](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/2025-09-30)—
- (a) Part [1](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/1/2025-09-30) contains minor and consequential amendments, and
- (b) Part [2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2/2025-09-30) contains transitional provision.
- (1) [Schedule 7](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/2025-11-17) amends Chapter 5 of the UK GDPR (general processing and transfers of personal data to third countries and international organisations).
- (2) [Schedule 8](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/2025-11-17) amends Chapter 5 of Part 3 of the 2018 Act (law enforcement processing and transfers of personal data to third countries and international organisations).
- (3) In Schedule [9](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/2025-11-17)—
- (a) Part [1](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/1/2025-11-17) contains minor and consequential amendments, and
- (b) Part [2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2/2025-11-17) contains transitional provision.
### Safeguards for processing for research etc purposes
@@ -3576,7 +3576,7 @@
##### 86
- (1) The UK GDPR is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/86/2/2025-09-30) to [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/86/4/2025-09-30).
- (1) The UK GDPR is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/86/2/2025-11-17) to [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/86/4/2025-11-17).
- (2) After Chapter 8 insert—
@@ -3609,7 +3609,7 @@
- (4) Omit Article 89 (safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes).
- (5) The 2018 Act is amended in accordance with subsections [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/86/6/2025-09-30) and [(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/86/7/2025-09-30).
- (5) The 2018 Act is amended in accordance with subsections [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/86/6/2025-11-17) and [(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/86/7/2025-11-17).
- (6) Omit section 19 (processing for archiving, research and statistical purposes: safeguards) and the italic heading before it.
@@ -3653,7 +3653,7 @@
##### 88
- (1) The 2018 Act is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/2/2025-09-30) to [(10)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/10/2025-09-30).
- (1) The 2018 Act is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/2/2025-11-17) to [(10)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/10/2025-11-17).
- (2) In section 26(2)(f) (national security and defence exemption), before sub-paragraph (i) insert—
@@ -3773,7 +3773,7 @@
.
- (11) In the provisions listed in subsection [(12)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/12/2025-09-30), for “subsection (4) of that section” substitute “section 45(4) or 78A of that Act”.
- (11) In the provisions listed in subsection [(12)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/12/2025-11-17), for “subsection (4) of that section” substitute “section 45(4) or 78A of that Act”.
- (12) The provisions are—
@@ -3901,7 +3901,7 @@
##### 90
- (1) The 2018 Act is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/2/2025-09-30) to [(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/9/2025-09-30).
- (1) The 2018 Act is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/2/2025-11-17) to [(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/9/2025-11-17).
- (2) In section 1(5) (overview: Part 4), at the end insert “(and certain processing carried out by competent authorities jointly with the intelligence services)”.
@@ -3974,7 +3974,7 @@
##### 91
- (1) The 2018 Act is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/91/2/2025-09-30) to [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/91/4/2025-09-30).
- (1) The 2018 Act is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/91/2/2025-11-17) to [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/91/4/2025-11-17).
- (2) Omit section 2(2) (duty of Commissioner when carrying out functions).
@@ -4022,7 +4022,7 @@
##### 92
- (1) The 2018 Act is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/92/2/2025-09-30) to [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/92/6/2025-09-30).
- (1) The 2018 Act is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/92/2/2025-11-17) to [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/92/6/2025-11-17).
- (2) After section 124 insert—
@@ -4090,7 +4090,7 @@
##### 93
In the 2018 Act, after section [124A](#p11128) (inserted by [section 92](https://www.legislation.gov.uk/ukpga/2025/18/section/92/2025-09-30) of this Act) insert—
In the 2018 Act, after section [124A](#p11128) (inserted by [section 92](https://www.legislation.gov.uk/ukpga/2025/18/section/92/2025-11-17) of this Act) insert—
> (124B)
> (1) This section applies where a code is prepared under section 121, 122, 123, 124 or [124A](#p11128), subject to subsection [(11)](#p11428).
@@ -4138,7 +4138,7 @@
##### 94
- (1) The 2018 Act is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/94/2/2025-09-30) and [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/94/3/2025-09-30).
- (1) The 2018 Act is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/94/2/2025-11-17) and [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/94/3/2025-11-17).
- (2) In section 135 (manifestly unfounded or excessive requests made to the Commissioner)—
@@ -4187,7 +4187,7 @@
##### 96
- (1) The 2018 Act is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/96/2/2025-09-30) and [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/96/3/2025-09-30).
- (1) The 2018 Act is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/96/2/2025-11-17) and [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/96/3/2025-11-17).
- (2) Omit section 141 (notices from the Commissioner).
@@ -4574,7 +4574,7 @@
##### 103
- (1) The 2018 Act is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/103/2/2025-09-30) and [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/103/3/2025-09-30).
- (1) The 2018 Act is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/103/2/2025-11-17) and [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/103/3/2025-11-17).
- (2) Before section 165 (but after the italic heading before it) insert—
@@ -4606,7 +4606,7 @@
- (b) in subsection (2), after “infringement of” insert “the UK GDPR or”.
- (4) The UK GDPR is amended in accordance with subsections [(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/103/5/2025-09-30) and [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/103/6/2025-09-30).
- (4) The UK GDPR is amended in accordance with subsections [(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/103/5/2025-11-17) and [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/103/6/2025-11-17).
- (5) In Article 57 (Commissioner’s tasks)—
@@ -4616,7 +4616,7 @@
- (6) Omit Article 77 (right to lodge a complaint with the Commissioner).
- (7) [Schedule 10](https://www.legislation.gov.uk/ukpga/2025/18/schedule/10/2025-09-30) to this Act contains minor and consequential amendments.
- (7) [Schedule 10](https://www.legislation.gov.uk/ukpga/2025/18/schedule/10/2025-11-17) to this Act contains minor and consequential amendments.
#### Court procedure in connection with subject access requests
@@ -4719,21 +4719,21 @@
##### 106
- (1) The 2018 Act is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/2/2025-09-30) to [(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/5/2025-09-30).
- (1) The 2018 Act is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/2/2025-11-17) to [(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/5/2025-11-17).
- (2) After section 183 insert—
> (183A)
> (1) A relevant enactment or rule of law which imposes a duty, or confers a power, to process personal data does not override a requirement under the main data protection legislation relating to the processing of personal data.
> (2) Subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/1/2025-09-30) does not apply—
> (2) Subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/1/2025-11-17) does not apply—
> (a) to a relevant enactment forming part of the main data protection legislation, or
> (b) to the extent that an enactment makes express provision to the contrary referring to this section or to the main data protection legislation (or a provision of that legislation).
> (3) Subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/1/2025-09-30) does not prevent a duty or power to process personal data from being taken into account for the purpose of determining whether it is possible to rely on an exception to a requirement under the main data protection legislation that is available where there is such a duty or power.
> (3) Subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/1/2025-11-17) does not prevent a duty or power to process personal data from being taken into account for the purpose of determining whether it is possible to rely on an exception to a requirement under the main data protection legislation that is available where there is such a duty or power.
> (4) In this section—
> - “*the main data protection legislation*” means the data protection legislation other than provision of or made under— Chapter 6 or 8 of the UK GDPR, or Parts 5 to 7 of this Act;
> - “*relevant enactment*” means an enactment so far as passed or made on or after the day on which section [106](https://www.legislation.gov.uk/ukpga/2025/18/section/106/2025-09-30)[(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/2/2025-09-30) of the Data (Use and Access) Act 2025 comes into force;
> - “*relevant enactment*” means an enactment so far as passed or made on or after the day on which section [106](https://www.legislation.gov.uk/ukpga/2025/18/section/106/2025-11-17)[(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/2/2025-11-17) of the Data (Use and Access) Act 2025 comes into force;
> - “*requirement*” includes a prohibition or restriction.
> (5) The reference in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/1/2025-09-30) to an enactment or rule of law which imposes a duty, or confers a power, to process personal data is a reference to an enactment or rule of law which, directly or indirectly, requires or authorises the processing of personal data, including (for example)—
> (5) The reference in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/1/2025-11-17) to an enactment or rule of law which imposes a duty, or confers a power, to process personal data is a reference to an enactment or rule of law which, directly or indirectly, requires or authorises the processing of personal data, including (for example)—
> (a) by authorising one person to require another person to process personal data, or
> (b) by removing restrictions on processing personal data,
> and the references in subsection [(3)](#p13049) to a duty or power are to be read accordingly.
@@ -4749,7 +4749,7 @@
> (4) Nothing is to be implied about a relationship described in subsection [(1)](#p13107) merely due to the fact that express provision with similar effect to section [183A](#p13030)[(1)](#p13032) (or applying that provision) is made in connection with one such relationship but not another.
> (5) In this section—
> (a) “*the main data protection legislation*” and “*requirement*” have the same meaning as in section [183A](#p13030), and
> (b) “*pre-commencement enactment*” means an enactment so far as passed or made before the day on which section [106](https://www.legislation.gov.uk/ukpga/2025/18/section/106/2025-09-30)[(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/2/2025-09-30) of the Data (Use and Access) Act 2025 comes into force.
> (b) “*pre-commencement enactment*” means an enactment so far as passed or made before the day on which section [106](https://www.legislation.gov.uk/ukpga/2025/18/section/106/2025-11-17)[(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/2/2025-11-17) of the Data (Use and Access) Act 2025 comes into force.
> (6) Section [183A](#p13030)[(5)](#p13080) applies for the purposes of subsection [(1)](#p13107)[(a)](#p13110) of this section as it applies for the purposes of section [183A](#p13030)[(1)](#p13032).
- (4) In section 186 (data subject’s rights and other prohibitions and restrictions)—
@@ -4783,7 +4783,7 @@
> (2) The relationship is not changed by section 5(A1) of the European Union (Withdrawal) Act 2018 (removal of the principle of supremacy of EU law) (or the repeal of section 5(1) to (3) of that Act).
> (3) Subsection (1) of section 186 does not apply to the relationship so far as there is a contrary intention, whether express or implied (taking account of, among other things, subsection [(2)](#p13240) of this section).
> (4) Nothing is to be implied about a relationship described in subsection [(1)](#p13107) merely due to the fact that express provision stating that section 186(1) applies (or with similar effect) is made in connection with one such relationship but not another.
> (5) In this section, “*pre-commencement enactment*” means an enactment so far as passed or made before the day on which section [106](https://www.legislation.gov.uk/ukpga/2025/18/section/106/2025-09-30)[(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/4/2025-09-30) of the Data (Use and Access) Act 2025 comes into force, other than an enactment contained in, or made under, a provision listed in section 186(2) or (3).
> (5) In this section, “*pre-commencement enactment*” means an enactment so far as passed or made before the day on which section [106](https://www.legislation.gov.uk/ukpga/2025/18/section/106/2025-11-17)[(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/4/2025-11-17) of the Data (Use and Access) Act 2025 comes into force, other than an enactment contained in, or made under, a provision listed in section 186(2) or (3).
- (6) In section 5 of the European Union (Withdrawal) Act 2018 (exceptions to savings and incorporation), in subsection (A3)(a)—
@@ -4793,7 +4793,7 @@
- (c) at the end insert “(and see also section [183B](#p13105)[(3)](#p13123) of that Act)”.
- (7) Subsections [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/3/2025-09-30), [(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/5/2025-09-30) and [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/6/2025-09-30)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/6/c/2025-09-30) are to be treated as having come into force on 1 January 2024.
- (7) Subsections [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/3/2025-11-17), [(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/5/2025-11-17) and [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/6/2025-11-17)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/6/c/2025-11-17) are to be treated as having come into force on 1 January 2024.
### Miscellaneous
@@ -4834,7 +4834,7 @@
##### 108
[Schedule 11](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/2025-09-30) contains further minor provision about data protection.
[Schedule 11](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/2025-11-17) contains further minor provision about data protection.
### Chapter 2 — Privacy and electronic communications
@@ -4922,7 +4922,7 @@
##### 112
- (1) The PEC Regulations are amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/112/2/2025-09-30) and [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/112/3/2025-09-30).
- (1) The PEC Regulations are amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/112/2/2025-11-17) and [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/112/3/2025-11-17).
- (2) For regulation 6 (storing information, or gaining access to information stored, in the terminal equipment of a subscriber or user) substitute—
@@ -4946,9 +4946,9 @@
> (b) such other persons as the Secretary of State considers appropriate.
> (4) A statutory instrument containing regulations under paragraph [(1)](#p13622) may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament.
- (4) Schedule [12](https://www.legislation.gov.uk/ukpga/2025/18/schedule/12/2025-09-30) to this Act inserts Schedule [A1](#p21167) to the PEC Regulations.
- (5) A requirement to consult under regulation 6A of the PEC Regulations (inserted by subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/112/3/2025-09-30) of this section) may be satisfied by consultation undertaken before the day on which this Act is passed.
- (4) Schedule [12](https://www.legislation.gov.uk/ukpga/2025/18/schedule/12/2025-11-17) to this Act inserts Schedule [A1](#p21167) to the PEC Regulations.
- (5) A requirement to consult under regulation 6A of the PEC Regulations (inserted by subsection [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/112/3/2025-11-17) of this section) may be satisfied by consultation undertaken before the day on which this Act is passed.
#### Emergency alerts: interpretation of time periods
@@ -4985,7 +4985,7 @@
##### 115
- (1) The PEC Regulations are amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/115/2/2025-09-30) to [(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/115/8/2025-09-30).
- (1) The PEC Regulations are amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/115/2/2025-11-17) to [(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/115/8/2025-11-17).
- (2) In regulation 5 (security of public electronic communications services), omit paragraph (6).
@@ -5021,11 +5021,11 @@
- (7) Omit regulation 31B (appeals against third party information notices).
- (8) For Schedule 1 substitute the Schedule set out in Schedule [13](https://www.legislation.gov.uk/ukpga/2025/18/schedule/13/2025-09-30) to this Act.
- (8) For Schedule 1 substitute the Schedule set out in Schedule [13](https://www.legislation.gov.uk/ukpga/2025/18/schedule/13/2025-11-17) to this Act.
- (9) In paragraph 58(1) of Schedule 20 to the Data Protection Act 2018 (transitional provision relating to the PEC Regulations) for “regulations 2, 31 and 31B of, and Schedule 1 to,” substitute “regulation 2 of”.
- (10) A requirement to consult under regulation 5C[(15)](#p13810) of the PEC Regulations (inserted by subsection [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/115/4/2025-09-30)[(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/115/4/b/2025-09-30) of this section) may be satisfied by consultation undertaken before the day on which this Act is passed.
- (10) A requirement to consult under regulation 5C[(15)](#p13810) of the PEC Regulations (inserted by subsection [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/115/4/2025-11-17)[(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/115/4/b/2025-11-17) of this section) may be satisfied by consultation undertaken before the day on which this Act is passed.
#### Codes of conduct
@@ -5088,7 +5088,7 @@
> (a) the Commissioner’s enforcement functions, or
> (b) the Commissioner’s functions under regulation 32A or 32B (codes of conduct).
- (4) In Schedule 1 (Commissioner’s enforcement powers) (inserted by Schedule [13](https://www.legislation.gov.uk/ukpga/2025/18/schedule/13/2025-09-30) to this Act), in paragraph 18(b)(ii) (maximum amount of penalty), for “or 24” substitute “, 24 or 32B(4) or (5)”.
- (4) In Schedule 1 (Commissioner’s enforcement powers) (inserted by Schedule [13](https://www.legislation.gov.uk/ukpga/2025/18/schedule/13/2025-11-17) to this Act), in paragraph 18(b)(ii) (maximum amount of penalty), for “or 24” substitute “, 24 or 32B(4) or (5)”.
## Part 6 — The Information Commission
@@ -5163,7 +5163,7 @@
- (1) The functions of the Information Commissioner are transferred to the Information Commission.
- (2) So far as is appropriate in consequence of [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/119/1/2025-09-30), a reference to the Information Commissioner (however expressed) in an enactment or other document whenever passed or made (including this Act) is to be treated as a reference to the Information Commission.
- (2) So far as is appropriate in consequence of [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/119/1/2025-11-17), a reference to the Information Commissioner (however expressed) in an enactment or other document whenever passed or made (including this Act) is to be treated as a reference to the Information Commission.
- (3) In this section, “*enactment*” includes—
@@ -5217,7 +5217,7 @@
##### 121
[Schedule 15](https://www.legislation.gov.uk/ukpga/2025/18/schedule/15/2025-09-30) makes provision about information standards for health and adult social care in England (under Part 9 of the Health and Social Care Act 2012) and information technology.
[Schedule 15](https://www.legislation.gov.uk/ukpga/2025/18/schedule/15/2025-11-17) makes provision about information standards for health and adult social care in England (under Part 9 of the Health and Social Care Act 2012) and information technology.
### Smart meter communication services
@@ -5225,7 +5225,7 @@
##### 122
Schedule [16](https://www.legislation.gov.uk/ukpga/2025/18/schedule/16/2025-09-30) makes provision in connection with the grant of smart meter communication licences.
Schedule [16](https://www.legislation.gov.uk/ukpga/2025/18/schedule/16/2025-11-17) makes provision in connection with the grant of smart meter communication licences.
### Information to improve public service delivery
@@ -5412,7 +5412,7 @@
##### 125
- (1) The Online Safety Act 2023 is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/125/2/2025-09-30) to [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/125/4/2025-09-30).
- (1) The Online Safety Act 2023 is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/125/2/2025-11-17) to [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/125/4/2025-11-17).
- (2) After section 154 insert—
@@ -5477,11 +5477,11 @@
##### 126
- (1) Part 1 of the Counter-Terrorism Act 2008 (powers to gather and share information) is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/126/2/2025-09-30) to [(10)](https://www.legislation.gov.uk/ukpga/2025/18/section/126/10/2025-09-30).
- (1) Part 1 of the Counter-Terrorism Act 2008 (powers to gather and share information) is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/126/2/2025-11-17) to [(10)](https://www.legislation.gov.uk/ukpga/2025/18/section/126/10/2025-11-17).
- (2) In section 18A(3) (retention of material: general), after “recordable offence” insert “or recordable-equivalent offence”.
- (3) Section 18E (supplementary provision) is amended in accordance with subsections [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/126/4/2025-09-30) to [(10)](https://www.legislation.gov.uk/ukpga/2025/18/section/126/10/2025-09-30).
- (3) Section 18E (supplementary provision) is amended in accordance with subsections [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/126/4/2025-11-17) to [(10)](https://www.legislation.gov.uk/ukpga/2025/18/section/126/10/2025-11-17).
- (4) In subsection (1), after the definition of “recordable offence” insert—
@@ -5531,13 +5531,13 @@
- (b) in the period of 3 years ending immediately before the commencement day.
- (12) Subsection [(13)](https://www.legislation.gov.uk/ukpga/2025/18/section/126/13/2025-09-30) of this section applies where—
- (12) Subsection [(13)](https://www.legislation.gov.uk/ukpga/2025/18/section/126/13/2025-11-17) of this section applies where—
- (a) at the beginning of the commencement day, a law enforcement authority has section 18 material which it obtained or acquired in the period of 3 years ending immediately before the commencement day,
- (b) at a time before the commencement day (a “pre-commencement time”), the law enforcement authority was required by section 18(4) of the Counter-Terrorism Act 2008 to destroy the material, and
- (c) at the pre-commencement time, the law enforcement authority could have retained the material under section 18A of the Counter-Terrorism Act 2008, as it has effect taking account of the amendments made by subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/126/2/2025-09-30) to [(10)](https://www.legislation.gov.uk/ukpga/2025/18/section/126/10/2025-09-30) of this section, if those amendments had been in force.
- (c) at the pre-commencement time, the law enforcement authority could have retained the material under section 18A of the Counter-Terrorism Act 2008, as it has effect taking account of the amendments made by subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/126/2/2025-11-17) to [(10)](https://www.legislation.gov.uk/ukpga/2025/18/section/126/10/2025-11-17) of this section, if those amendments had been in force.
- (13) Where this subsection applies—
@@ -5569,9 +5569,9 @@
##### 127
- (1) Part 1 of the Counter-Terrorism Act 2008 (powers to gather and share information) is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/127/2/2025-09-30) to [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/127/6/2025-09-30).
- (2) Section 18A (retention of material: general) is amended in accordance with subsections [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/126/3/2025-09-30) to [(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/127/5/2025-09-30).
- (1) Part 1 of the Counter-Terrorism Act 2008 (powers to gather and share information) is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/127/2/2025-11-17) to [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/127/6/2025-11-17).
- (2) Section 18A (retention of material: general) is amended in accordance with subsections [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/126/3/2025-11-17) to [(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/127/5/2025-11-17).
- (3) In subsection (1), for “subsection (5)” substitute “subsections (4) to (9)”.
@@ -5610,7 +5610,7 @@
- (b) in the period of 3 years ending immediately before the commencement day.
- (8) Subsections [(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/127/9/2025-09-30) to [(12)](https://www.legislation.gov.uk/ukpga/2025/18/section/127/12/2025-09-30) of this section apply where, at the beginning of the commencement day, a law enforcement authority has section 18 material which it obtained or acquired in the period of 3 years ending immediately before the commencement day.
- (8) Subsections [(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/127/9/2025-11-17) to [(12)](https://www.legislation.gov.uk/ukpga/2025/18/section/127/12/2025-11-17) of this section apply where, at the beginning of the commencement day, a law enforcement authority has section 18 material which it obtained or acquired in the period of 3 years ending immediately before the commencement day.
- (9) Where the law enforcement authority holds the material in a pseudonymised form at the beginning of the commencement day, the authority is to be treated for the purposes of section 18A(7)(c) and (d) of the Counter-Terrorism Act 2008 as having—
@@ -5620,11 +5620,11 @@
- (10) Where the law enforcement authority does not hold the material in a pseudonymised form at the beginning of the commencement day, the authority is to be treated for the purposes of section 18A(7)(c) of the Counter-Terrorism Act 2008 as taking the steps necessary for it to hold the material in a pseudonymised form as soon as reasonably practicable after obtaining or acquiring the material if it takes those steps on, or as soon as reasonably practicable after, the commencement day.
- (11) Subsection [(12)](https://www.legislation.gov.uk/ukpga/2025/18/section/127/12/2025-09-30) of this section applies where, at a time before the commencement day (a “pre-commencement time”), the law enforcement authority was required by section 18(4) of the Counter-Terrorism Act 2008 to destroy the material but—
- (11) Subsection [(12)](https://www.legislation.gov.uk/ukpga/2025/18/section/127/12/2025-11-17) of this section applies where, at a time before the commencement day (a “pre-commencement time”), the law enforcement authority was required by section 18(4) of the Counter-Terrorism Act 2008 to destroy the material but—
- (a) at the pre-commencement time, the law enforcement authority could have retained the material under section 18A(7) to (9) of the Counter-Terrorism Act 2008 (as inserted by this section) if those provisions had been in force, or
- (b) on or after the commencement day, the law enforcement authority may retain the material under those provisions by virtue of subsection [(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/127/9/2025-09-30) or [(10)](https://www.legislation.gov.uk/ukpga/2025/18/section/127/10/2025-09-30) of this section.
- (b) on or after the commencement day, the law enforcement authority may retain the material under those provisions by virtue of subsection [(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/127/9/2025-11-17) or [(10)](https://www.legislation.gov.uk/ukpga/2025/18/section/127/10/2025-11-17) of this section.
- (12) Where this subsection applies—
@@ -5638,17 +5638,17 @@
- (13) In this section—
- “*the commencement day*”, “law enforcement authority” and “section 18 material” have the meaning given in section [126](https://www.legislation.gov.uk/ukpga/2025/18/section/126/2025-09-30)[(14)](https://www.legislation.gov.uk/ukpga/2025/18/section/126/14/2025-09-30);
- “*the commencement day*”, “law enforcement authority” and “section 18 material” have the meaning given in section [126](https://www.legislation.gov.uk/ukpga/2025/18/section/126/2025-11-17)[(14)](https://www.legislation.gov.uk/ukpga/2025/18/section/126/14/2025-11-17);
- “*in a pseudonymised form*” has the meaning given by section 18A(4) of the Counter-Terrorism Act 2008 (as amended by this section);
- “*instituted*”, in relation to proceedings, has the meaning given in section [126](https://www.legislation.gov.uk/ukpga/2025/18/section/126/2025-09-30)[(15)](https://www.legislation.gov.uk/ukpga/2025/18/section/126/15/2025-09-30).
- “*instituted*”, in relation to proceedings, has the meaning given in section [126](https://www.legislation.gov.uk/ukpga/2025/18/section/126/2025-11-17)[(15)](https://www.legislation.gov.uk/ukpga/2025/18/section/126/15/2025-11-17).
#### Retention of biometric data from INTERPOL
##### 128
- (1) Part 1 of the Counter-Terrorism Act 2008 (powers to gather and share information) is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/128/2/2025-09-30) to [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/128/4/2025-09-30).
- (1) Part 1 of the Counter-Terrorism Act 2008 (powers to gather and share information) is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/128/2/2025-11-17) to [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/128/4/2025-11-17).
- (2) In section 18(4) (destruction of national security material not subject to existing statutory restrictions), after “18A” insert “, 18AA”.
@@ -5661,7 +5661,7 @@
> (4) In this section—
> - “*INTERPOL*” means the organisation called the International Criminal Police Organization - INTERPOL;
> - “*the National Central Bureau*” means the body appointed for the time being in accordance with INTERPOL’s constitution to serve as the United Kingdom’s National Central Bureau.
> (5) The reference in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/128/1/2025-09-30) to material obtained or acquired as part of a request or notification includes material obtained or acquired as part of a communication, sent to the United Kingdom via INTERPOL’s systems, correcting, updating or otherwise supplementing the request or notification.
> (5) The reference in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/128/1/2025-11-17) to material obtained or acquired as part of a request or notification includes material obtained or acquired as part of a communication, sent to the United Kingdom via INTERPOL’s systems, correcting, updating or otherwise supplementing the request or notification.
> (18AB)
> (1) The Secretary of State may by regulations amend section 18AA to make such changes as the Secretary of State considers appropriate in consequence of—
> (a) changes to the name of the organisation which, when section 18AA was enacted, was called the International Criminal Police Organization - INTERPOL (“the organisation”),
@@ -5673,7 +5673,7 @@
- (5) Section 18AA of the Counter-Terrorism Act 2008 applies in relation to section 18 material obtained or acquired by a law enforcement authority before the commencement day (as well as material obtained or acquired on or after that day), except where the law enforcement authority was informed, or became aware, as described in subsection [(2)](#p15435) or [(3)](#p15439) of that section before the commencement day.
- (6) Subsection [(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/128/7/2025-09-30) of this section applies where—
- (6) Subsection [(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/128/7/2025-11-17) of this section applies where—
- (a) at the beginning of the commencement day, a law enforcement authority has section 18 material,
@@ -5693,9 +5693,9 @@
- (8) In this section—
- “*the commencement day*”, “law enforcement authority” and “section 18 material” have the meaning given in section [126](https://www.legislation.gov.uk/ukpga/2025/18/section/126/2025-09-30)[(14)](https://www.legislation.gov.uk/ukpga/2025/18/section/126/14/2025-09-30);
- “*instituted*”, in relation to proceedings, has the meaning given in section [126](https://www.legislation.gov.uk/ukpga/2025/18/section/126/2025-09-30)[(15)](https://www.legislation.gov.uk/ukpga/2025/18/section/126/15/2025-09-30).
- “*the commencement day*”, “law enforcement authority” and “section 18 material” have the meaning given in section [126](https://www.legislation.gov.uk/ukpga/2025/18/section/126/2025-11-17)[(14)](https://www.legislation.gov.uk/ukpga/2025/18/section/126/14/2025-11-17);
- “*instituted*”, in relation to proceedings, has the meaning given in section [126](https://www.legislation.gov.uk/ukpga/2025/18/section/126/2025-11-17)[(15)](https://www.legislation.gov.uk/ukpga/2025/18/section/126/15/2025-11-17).
### Trust services
@@ -5703,7 +5703,7 @@
##### 129
In sections [130](https://www.legislation.gov.uk/ukpga/2025/18/section/130/2025-09-30) to [134](https://www.legislation.gov.uk/ukpga/2025/18/section/134/2025-09-30), “*the eIDAS Regulation*” means [Regulation (EU) No. 910/2014](https://www.legislation.gov.uk/european/regulation/2014/0910) of the European Parliament and the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market.
In sections [130](https://www.legislation.gov.uk/ukpga/2025/18/section/130/2025-11-17) to [134](https://www.legislation.gov.uk/ukpga/2025/18/section/134/2025-11-17), “*the eIDAS Regulation*” means [Regulation (EU) No. 910/2014](https://www.legislation.gov.uk/european/regulation/2014/0910) of the European Parliament and the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market.
#### Recognition of EU conformity assessment bodies
@@ -5727,19 +5727,19 @@
- (d) revoke Article 51 of the eIDAS Regulation (transitional measures for electronic signatures);
- (e) amend a provision listed in [subsection (3)](https://www.legislation.gov.uk/ukpga/2025/18/section/131/3/2025-09-30) so as to remove a reference to a trust service provider established in the EU;
- (f) amend a provision listed in [subsection (4)](https://www.legislation.gov.uk/ukpga/2025/18/section/131/4/2025-09-30) so as to remove a reference to European standards or provisions of equivalent EU law.
- (2) The power under [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/131/1/2025-09-30)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/131/1/a/2025-09-30) includes power to amend or remove an assumption in Article 24A(2) of the eIDAS Regulation.
- (3) The provisions mentioned in [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/131/1/2025-09-30)[(e)](https://www.legislation.gov.uk/ukpga/2025/18/section/131/1/e/2025-09-30) are—
- (e) amend a provision listed in [subsection (3)](https://www.legislation.gov.uk/ukpga/2025/18/section/131/3/2025-11-17) so as to remove a reference to a trust service provider established in the EU;
- (f) amend a provision listed in [subsection (4)](https://www.legislation.gov.uk/ukpga/2025/18/section/131/4/2025-11-17) so as to remove a reference to European standards or provisions of equivalent EU law.
- (2) The power under [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/131/1/2025-11-17)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/131/1/a/2025-11-17) includes power to amend or remove an assumption in Article 24A(2) of the eIDAS Regulation.
- (3) The provisions mentioned in [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/131/1/2025-11-17)[(e)](https://www.legislation.gov.uk/ukpga/2025/18/section/131/1/e/2025-11-17) are—
- (a) Article 13(1) of the eIDAS Regulation;
- (b) Articles 2(1)(a) and 4(1)(a) of the Implementing Decision.
- (4) The provisions mentioned in [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/131/1/2025-09-30)[(f)](https://www.legislation.gov.uk/ukpga/2025/18/section/131/1/f/2025-09-30) are—
- (4) The provisions mentioned in [subsection (1)](https://www.legislation.gov.uk/ukpga/2025/18/section/131/1/2025-11-17)[(f)](https://www.legislation.gov.uk/ukpga/2025/18/section/131/1/f/2025-11-17) are—
- (a) Article 24(2)(b) of the eIDAS Regulation;
@@ -5853,7 +5853,7 @@
- (b) lay a document containing the assessment before Parliament.
- (2) The document may include an assessment of the economic impact in the United Kingdom of policy options which are alternatives to the options described in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/135/1/2025-09-30)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/135/1/a/2025-09-30).
- (2) The document may include an assessment of the economic impact in the United Kingdom of policy options which are alternatives to the options described in subsection [(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/135/1/2025-11-17)[(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/135/1/a/2025-11-17).
- (3) An assessment included in the document must, among other things, include assessment of the economic impact of each option on—
@@ -5925,7 +5925,7 @@
including enforcement by a regulator.
- (4) The consideration and proposals under each of paragraphs [(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/136/3/a/2025-09-30) to [(e)](https://www.legislation.gov.uk/ukpga/2025/18/section/136/3/e/2025-09-30) of [subsection (3)](https://www.legislation.gov.uk/ukpga/2025/18/section/136/3/2025-09-30) must include consideration of, and proposals relating to, AI systems developed outside the United Kingdom.
- (4) The consideration and proposals under each of paragraphs [(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/136/3/a/2025-11-17) to [(e)](https://www.legislation.gov.uk/ukpga/2025/18/section/136/3/e/2025-11-17) of [subsection (3)](https://www.legislation.gov.uk/ukpga/2025/18/section/136/3/2025-11-17) must include consideration of, and proposals relating to, AI systems developed outside the United Kingdom.
- (5) In preparing the report, the Secretary of State must consider the likely effect of proposals, in the United Kingdom, on—
@@ -5949,7 +5949,7 @@
- “*web crawler*” means a computer program that obtains data from websites in accordance with instructions and that can autonomously determine which websites to visit.
- (9) Terms used in this section and in [section 135](https://www.legislation.gov.uk/ukpga/2025/18/section/135/2025-09-30) have the same meaning in this section as they have in that section.
- (9) Terms used in this section and in [section 135](https://www.legislation.gov.uk/ukpga/2025/18/section/135/2025-11-17) have the same meaning in this section as they have in that section.
#### Progress statement
@@ -5957,9 +5957,9 @@
- (1) The Secretary of State must, before the end of the period of 6 months beginning with the day on which this Act is passed, lay before Parliament a statement setting out what progress has been made towards the publication of—
- (a) the economic impact assessment required by [section 135](https://www.legislation.gov.uk/ukpga/2025/18/section/135/2025-09-30), and
- (b) the report required by [section 136](https://www.legislation.gov.uk/ukpga/2025/18/section/136/2025-09-30).
- (a) the economic impact assessment required by [section 135](https://www.legislation.gov.uk/ukpga/2025/18/section/135/2025-11-17), and
- (b) the report required by [section 136](https://www.legislation.gov.uk/ukpga/2025/18/section/136/2025-11-17).
- (2) The duty in subsection (1) does not apply where the economic impact assessment and the report have been published before the end of the period described in that subsection.
@@ -5969,7 +5969,7 @@
##### 138
- (1) The Sexual Offences Act 2003 is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/138/2/2025-09-30) and [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/138/3/2025-09-30).
- (1) The Sexual Offences Act 2003 is amended in accordance with subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/138/2/2025-11-17) and [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/138/3/2025-11-17).
- (2) After section 66D insert—
@@ -6079,13 +6079,13 @@
- (c) may amend, repeal or revoke any provision made by an enactment.
- (3) The reference in [subsection (2)](https://www.legislation.gov.uk/ukpga/2025/18/section/139/2/2025-09-30)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/139/2/c/2025-09-30) to provision made by an enactment is—
- (a) where the amendment, repeal or revocation is consequential on [section 117](https://www.legislation.gov.uk/ukpga/2025/18/section/117/2025-09-30), [118](https://www.legislation.gov.uk/ukpga/2025/18/section/118/2025-09-30) or [119](https://www.legislation.gov.uk/ukpga/2025/18/section/119/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/119/1/2025-09-30) or [Schedule 14](https://www.legislation.gov.uk/ukpga/2025/18/schedule/14/2025-09-30), a reference to provision made by an enactment whenever passed or made (including this Act), and
- (3) The reference in [subsection (2)](https://www.legislation.gov.uk/ukpga/2025/18/section/139/2/2025-11-17)[(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/139/2/c/2025-11-17) to provision made by an enactment is—
- (a) where the amendment, repeal or revocation is consequential on [section 117](https://www.legislation.gov.uk/ukpga/2025/18/section/117/2025-11-17), [118](https://www.legislation.gov.uk/ukpga/2025/18/section/118/2025-11-17) or [119](https://www.legislation.gov.uk/ukpga/2025/18/section/119/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/119/1/2025-11-17) or [Schedule 14](https://www.legislation.gov.uk/ukpga/2025/18/schedule/14/2025-11-17), a reference to provision made by an enactment whenever passed or made (including this Act), and
- (b) in any other case, a reference to provision made by an enactment passed or made before the end of the Session in which this Act is passed.
- (4) Regulations under this section made in consequence of section [183A](#p13030) of the Data Protection Act 2018 (inserted by section [106](https://www.legislation.gov.uk/ukpga/2025/18/section/106/2025-09-30) of this Act) may amend, repeal or revoke provision which refers to the data protection legislation (as defined in section 3 of the Data Protection Act 2018) as they could if the provision referred instead to the main data protection legislation (as defined in section [183A](#p13030) of that Act).
- (4) Regulations under this section made in consequence of section [183A](#p13030) of the Data Protection Act 2018 (inserted by section [106](https://www.legislation.gov.uk/ukpga/2025/18/section/106/2025-11-17) of this Act) may amend, repeal or revoke provision which refers to the data protection legislation (as defined in section 3 of the Data Protection Act 2018) as they could if the provision referred instead to the main data protection legislation (as defined in section [183A](#p13030) of that Act).
- (5) Regulations under this section that amend, repeal or revoke primary legislation are subject to the affirmative resolution procedure.
@@ -6113,31 +6113,31 @@
##### 141
- (1) This Act extends to England and Wales, Scotland and Northern Ireland, subject to subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/141/2/2025-09-30) to [(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/141/5/2025-09-30).
- (2) In Part [3](https://www.legislation.gov.uk/ukpga/2025/18/part/3/2025-09-30) (National Underground Asset Register)—
- (a) sections [56](https://www.legislation.gov.uk/ukpga/2025/18/section/56/2025-09-30), [57](https://www.legislation.gov.uk/ukpga/2025/18/section/57/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/57/1/2025-09-30) to [(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/57/7/2025-09-30) and [60](https://www.legislation.gov.uk/ukpga/2025/18/section/60/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/60/1/2025-09-30) and Schedule [1](https://www.legislation.gov.uk/ukpga/2025/18/schedule/1/2025-09-30) extend to England and Wales only, and
- (b) sections [58](https://www.legislation.gov.uk/ukpga/2025/18/section/58/2025-09-30), [59](https://www.legislation.gov.uk/ukpga/2025/18/section/59/2025-09-30) and [60](https://www.legislation.gov.uk/ukpga/2025/18/section/60/2025-09-30)[(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/60/2/2025-09-30) and Schedule [2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/2/2025-09-30) extend to Northern Ireland only.
- (1) This Act extends to England and Wales, Scotland and Northern Ireland, subject to subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/141/2/2025-11-17) to [(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/141/5/2025-11-17).
- (2) In Part [3](https://www.legislation.gov.uk/ukpga/2025/18/part/3/2025-11-17) (National Underground Asset Register)—
- (a) sections [56](https://www.legislation.gov.uk/ukpga/2025/18/section/56/2025-11-17), [57](https://www.legislation.gov.uk/ukpga/2025/18/section/57/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/57/1/2025-11-17) to [(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/57/7/2025-11-17) and [60](https://www.legislation.gov.uk/ukpga/2025/18/section/60/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/60/1/2025-11-17) and Schedule [1](https://www.legislation.gov.uk/ukpga/2025/18/schedule/1/2025-11-17) extend to England and Wales only, and
- (b) sections [58](https://www.legislation.gov.uk/ukpga/2025/18/section/58/2025-11-17), [59](https://www.legislation.gov.uk/ukpga/2025/18/section/59/2025-11-17) and [60](https://www.legislation.gov.uk/ukpga/2025/18/section/60/2025-11-17)[(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/60/2/2025-11-17) and Schedule [2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/2/2025-11-17) extend to Northern Ireland only.
- (3) In Part 4 (registers of births and deaths)—
- (a) sections [61](https://www.legislation.gov.uk/ukpga/2025/18/section/61/2025-09-30) to [64](https://www.legislation.gov.uk/ukpga/2025/18/section/64/2025-09-30) extend to England and Wales only, and
- (b) an amendment or repeal made by Schedule [3](https://www.legislation.gov.uk/ukpga/2025/18/schedule/3/2025-09-30) (minor and consequential amendments) has the same extent as the enactment amended or repealed.
- (4) In Part [6](https://www.legislation.gov.uk/ukpga/2025/18/part/6/2025-09-30) (the Information Commission), paragraph 23 of [Schedule 12A](#p22271) to the Data Protection Act 2018 (inserted by [Schedule 14](https://www.legislation.gov.uk/ukpga/2025/18/schedule/14/2025-09-30) to this Act) extends to England and Wales and Northern Ireland only.
- (5) In Part [7](https://www.legislation.gov.uk/ukpga/2025/18/part/7/2025-09-30)—
- (a) section [121](https://www.legislation.gov.uk/ukpga/2025/18/section/121/2025-09-30) and [Schedule 15](https://www.legislation.gov.uk/ukpga/2025/18/schedule/15/2025-09-30) (information standards for health and adult social care) extend to England and Wales only;
- (b) paragraphs [2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/16/paragraph/2/2025-09-30), [3](https://www.legislation.gov.uk/ukpga/2025/18/schedule/16/paragraph/3/2025-09-30) and [5](https://www.legislation.gov.uk/ukpga/2025/18/schedule/16/paragraph/5/2025-09-30) to [7](https://www.legislation.gov.uk/ukpga/2025/18/schedule/16/paragraph/7/2025-09-30) of Schedule [16](https://www.legislation.gov.uk/ukpga/2025/18/schedule/16/2025-09-30) (grant of smart meter communication licences) extend to England and Wales and Scotland only;
- (c) [section 138](https://www.legislation.gov.uk/ukpga/2025/18/section/138/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/138/1/2025-09-30) to [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/138/3/2025-09-30) and [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/138/6/2025-09-30) (creating, or requesting the creation of, purported intimate image of adult) extend to England and Wales only;
- (d) section [138](https://www.legislation.gov.uk/ukpga/2025/18/section/138/2025-09-30)[(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/138/4/2025-09-30) (amendment of the Armed Forces Act 2006) extends to—
- (a) sections [61](https://www.legislation.gov.uk/ukpga/2025/18/section/61/2025-11-17) to [64](https://www.legislation.gov.uk/ukpga/2025/18/section/64/2025-11-17) extend to England and Wales only, and
- (b) an amendment or repeal made by Schedule [3](https://www.legislation.gov.uk/ukpga/2025/18/schedule/3/2025-11-17) (minor and consequential amendments) has the same extent as the enactment amended or repealed.
- (4) In Part [6](https://www.legislation.gov.uk/ukpga/2025/18/part/6/2025-11-17) (the Information Commission), paragraph 23 of [Schedule 12A](#p22271) to the Data Protection Act 2018 (inserted by [Schedule 14](https://www.legislation.gov.uk/ukpga/2025/18/schedule/14/2025-11-17) to this Act) extends to England and Wales and Northern Ireland only.
- (5) In Part [7](https://www.legislation.gov.uk/ukpga/2025/18/part/7/2025-11-17)—
- (a) section [121](https://www.legislation.gov.uk/ukpga/2025/18/section/121/2025-11-17) and [Schedule 15](https://www.legislation.gov.uk/ukpga/2025/18/schedule/15/2025-11-17) (information standards for health and adult social care) extend to England and Wales only;
- (b) paragraphs [2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/16/paragraph/2/2025-11-17), [3](https://www.legislation.gov.uk/ukpga/2025/18/schedule/16/paragraph/3/2025-11-17) and [5](https://www.legislation.gov.uk/ukpga/2025/18/schedule/16/paragraph/5/2025-11-17) to [7](https://www.legislation.gov.uk/ukpga/2025/18/schedule/16/paragraph/7/2025-11-17) of Schedule [16](https://www.legislation.gov.uk/ukpga/2025/18/schedule/16/2025-11-17) (grant of smart meter communication licences) extend to England and Wales and Scotland only;
- (c) [section 138](https://www.legislation.gov.uk/ukpga/2025/18/section/138/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/138/1/2025-11-17) to [(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/138/3/2025-11-17) and [(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/138/6/2025-11-17) (creating, or requesting the creation of, purported intimate image of adult) extend to England and Wales only;
- (d) section [138](https://www.legislation.gov.uk/ukpga/2025/18/section/138/2025-11-17)[(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/138/4/2025-11-17) (amendment of the Armed Forces Act 2006) extends to—
- (i) England and Wales, Scotland and Northern Ireland,
@@ -6145,39 +6145,39 @@
- (iii) the British overseas territories, except Gibraltar;
- (e) section [138](https://www.legislation.gov.uk/ukpga/2025/18/section/138/2025-09-30)[(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/138/5/2025-09-30) (amendment of the Serious Crime Act 2007) extends to England and Wales and Northern Ireland only.
- (6) The powers conferred by section 384(1) and (2) of the Armed Forces Act 2006 (powers to extend provisions to the Channel Islands and to make provisions apply with modifications as they extend to the Channel Islands, the Isle of Man and British overseas territories other than Gibraltar) may be exercised in relation to section [177DA](#p16454) of that Act (inserted by section [138](https://www.legislation.gov.uk/ukpga/2025/18/section/138/2025-09-30)[(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/138/4/2025-09-30) of this Act).
- (7) The power conferred by section 63(3) of the Immigration, Asylum and Nationality Act 2006 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment made by section [55](https://www.legislation.gov.uk/ukpga/2025/18/section/55/2025-09-30) of this Act of any part of that Act (with or without modification or adaptation).
- (8) The power conferred by section 76(6) of the Immigration Act 2014 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment made by section [55](https://www.legislation.gov.uk/ukpga/2025/18/section/55/2025-09-30) of this Act of any part of that Act (with or without modifications).
- (9) The power conferred by section 95(5) of the Immigration Act 2016 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment made by section [55](https://www.legislation.gov.uk/ukpga/2025/18/section/55/2025-09-30) of this Act of any part of that Act (with or without modifications).
- (e) section [138](https://www.legislation.gov.uk/ukpga/2025/18/section/138/2025-11-17)[(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/138/5/2025-11-17) (amendment of the Serious Crime Act 2007) extends to England and Wales and Northern Ireland only.
- (6) The powers conferred by section 384(1) and (2) of the Armed Forces Act 2006 (powers to extend provisions to the Channel Islands and to make provisions apply with modifications as they extend to the Channel Islands, the Isle of Man and British overseas territories other than Gibraltar) may be exercised in relation to section [177DA](#p16454) of that Act (inserted by section [138](https://www.legislation.gov.uk/ukpga/2025/18/section/138/2025-11-17)[(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/138/4/2025-11-17) of this Act).
- (7) The power conferred by section 63(3) of the Immigration, Asylum and Nationality Act 2006 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment made by section [55](https://www.legislation.gov.uk/ukpga/2025/18/section/55/2025-11-17) of this Act of any part of that Act (with or without modification or adaptation).
- (8) The power conferred by section 76(6) of the Immigration Act 2014 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment made by section [55](https://www.legislation.gov.uk/ukpga/2025/18/section/55/2025-11-17) of this Act of any part of that Act (with or without modifications).
- (9) The power conferred by section 95(5) of the Immigration Act 2016 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment made by section [55](https://www.legislation.gov.uk/ukpga/2025/18/section/55/2025-11-17) of this Act of any part of that Act (with or without modifications).
- (10) The power conferred by section 239(7) of the Online Safety Act 2023 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment or repeal made by this Act of any part of that Act (with or without modifications).
- (11) In this section, “*enactment*” has the same meaning as in section [139](https://www.legislation.gov.uk/ukpga/2025/18/section/139/2025-09-30).
- (11) In this section, “*enactment*” has the same meaning as in section [139](https://www.legislation.gov.uk/ukpga/2025/18/section/139/2025-11-17).
#### Commencement
##### 142
- (1) Except as provided by subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/2025-09-30) to [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/4/2025-09-30), this Act comes into force on such day as the Secretary of State may by regulations appoint.
- (1) Except as provided by subsections [(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/2025-11-17) to [(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/4/2025-11-17), this Act comes into force on such day as the Secretary of State may by regulations appoint.
- (2) The following provisions come into force on the day on which this Act is passed—
- (a) section [66](https://www.legislation.gov.uk/ukpga/2025/18/section/66/2025-09-30) (meaning of “*the 2018 Act*” and “*the UK GDPR*”);
- (b) section [78](https://www.legislation.gov.uk/ukpga/2025/18/section/78/2025-09-30) (searches in response to data subjects’ requests);
- (c) Part [1](https://www.legislation.gov.uk/ukpga/2025/18/schedule/16/part/1/2025-09-30) of Schedule [16](https://www.legislation.gov.uk/ukpga/2025/18/schedule/16/2025-09-30) (grant of smart meter communication licences) and section [122](https://www.legislation.gov.uk/ukpga/2025/18/section/122/2025-09-30) so far as relating to that Part of that Schedule;
- (d) section [126](https://www.legislation.gov.uk/ukpga/2025/18/section/126/2025-09-30) (retention of biometric data and recordable offences);
- (e) section [127](https://www.legislation.gov.uk/ukpga/2025/18/section/127/2025-09-30) (retention of pseudonymised biometric data);
- (f) section [128](https://www.legislation.gov.uk/ukpga/2025/18/section/128/2025-09-30) (retention of biometric data from INTERPOL);
- (a) section [66](https://www.legislation.gov.uk/ukpga/2025/18/section/66/2025-11-17) (meaning of “*the 2018 Act*” and “*the UK GDPR*”);
- (b) section [78](https://www.legislation.gov.uk/ukpga/2025/18/section/78/2025-11-17) (searches in response to data subjects’ requests);
- (c) Part [1](https://www.legislation.gov.uk/ukpga/2025/18/schedule/16/part/1/2025-11-17) of Schedule [16](https://www.legislation.gov.uk/ukpga/2025/18/schedule/16/2025-11-17) (grant of smart meter communication licences) and section [122](https://www.legislation.gov.uk/ukpga/2025/18/section/122/2025-11-17) so far as relating to that Part of that Schedule;
- (d) section [126](https://www.legislation.gov.uk/ukpga/2025/18/section/126/2025-11-17) (retention of biometric data and recordable offences);
- (e) section [127](https://www.legislation.gov.uk/ukpga/2025/18/section/127/2025-11-17) (retention of pseudonymised biometric data);
- (f) section [128](https://www.legislation.gov.uk/ukpga/2025/18/section/128/2025-11-17) (retention of biometric data from INTERPOL);
- (g) this Part;
@@ -6185,15 +6185,15 @@
- (3) The following provisions come into force at the end of the period of two months beginning with the day on which this Act is passed—
- (a) [section 69](https://www.legislation.gov.uk/ukpga/2025/18/section/69/2025-09-30) (consent to law enforcement processing);
- (b) [section 82](https://www.legislation.gov.uk/ukpga/2025/18/section/82/2025-09-30) (logging of law enforcement processing);
- (c) section [96](https://www.legislation.gov.uk/ukpga/2025/18/section/96/2025-09-30) (notices from the Information Commissioner);
- (d) [section 97](https://www.legislation.gov.uk/ukpga/2025/18/section/97/2025-09-30) (power of the Information Commissioner to require documents).
- (4) [Part 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/16/part/2/2025-09-30) of Schedule [16](https://www.legislation.gov.uk/ukpga/2025/18/schedule/16/2025-09-30) (grant of smart meter communication licences), and section [122](https://www.legislation.gov.uk/ukpga/2025/18/section/122/2025-09-30) so far as relating to that Part of that Schedule, come into force on the day on which the first regulations under section [91A](#p23605)[(1)](#p23607) of the Energy Act 2008 (inserted by [Part 1](https://www.legislation.gov.uk/ukpga/2025/18/schedule/16/part/1/2025-09-30) of Schedule [16](https://www.legislation.gov.uk/ukpga/2025/18/schedule/16/2025-09-30)) come into force.
- (a) [section 69](https://www.legislation.gov.uk/ukpga/2025/18/section/69/2025-11-17) (consent to law enforcement processing);
- (b) [section 82](https://www.legislation.gov.uk/ukpga/2025/18/section/82/2025-11-17) (logging of law enforcement processing);
- (c) section [96](https://www.legislation.gov.uk/ukpga/2025/18/section/96/2025-11-17) (notices from the Information Commissioner);
- (d) [section 97](https://www.legislation.gov.uk/ukpga/2025/18/section/97/2025-11-17) (power of the Information Commissioner to require documents).
- (4) [Part 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/16/part/2/2025-11-17) of Schedule [16](https://www.legislation.gov.uk/ukpga/2025/18/schedule/16/2025-11-17) (grant of smart meter communication licences), and section [122](https://www.legislation.gov.uk/ukpga/2025/18/section/122/2025-11-17) so far as relating to that Part of that Schedule, come into force on the day on which the first regulations under section [91A](#p23605)[(1)](#p23607) of the Energy Act 2008 (inserted by [Part 1](https://www.legislation.gov.uk/ukpga/2025/18/schedule/16/part/1/2025-11-17) of Schedule [16](https://www.legislation.gov.uk/ukpga/2025/18/schedule/16/2025-11-17)) come into force.
- (5) Regulations under this section may make different provision for different purposes.
@@ -6203,9 +6203,9 @@
- (1) The Secretary of State may by regulations make transitional, transitory or saving provision in connection with the coming into force of any provision of this Act.
- (2) Regulations under this section may amend Schedule 21 to the Data Protection Act 2018 or [Part 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2/2025-09-30) of [Schedule 9](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/2025-09-30) to this Act by adding, varying or repealing provision.
- (3) Regulations under this section containing provision described in [subsection (2)](https://www.legislation.gov.uk/ukpga/2025/18/section/143/2/2025-09-30) are subject to the negative resolution procedure.
- (2) Regulations under this section may amend Schedule 21 to the Data Protection Act 2018 or [Part 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2/2025-11-17) of [Schedule 9](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/2025-11-17) to this Act by adding, varying or repealing provision.
- (3) Regulations under this section containing provision described in [subsection (2)](https://www.legislation.gov.uk/ukpga/2025/18/section/143/2/2025-11-17) are subject to the negative resolution procedure.
- (4) Regulations under this section may make different provision for different purposes.
@@ -6706,7 +6706,7 @@
##### 5
After Article 45B (inserted by [paragraph 4](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/paragraph/4/2025-09-30)) insert—
After Article 45B (inserted by [paragraph 4](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/paragraph/4/2025-11-17)) insert—
> (Article 45C)
> (1) The Secretary of State must, on an ongoing basis, monitor developments in third countries and international organisations that could affect decisions to make regulations under Article 45A or to amend or revoke such regulations.
@@ -7247,13 +7247,13 @@
##### 18
In section 75 (transfers on the basis of appropriate safeguards), after subsection (7) (inserted by Schedule [8](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/2025-09-30) to this Act) insert—
In section 75 (transfers on the basis of appropriate safeguards), after subsection (7) (inserted by Schedule [8](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/2025-11-17) to this Act) insert—
> (8) For provision about standard data protection clauses which the Commissioner considers are capable of securing that the data protection test in this section is met, see section 119A.
##### 19
In section 78A (law enforcement processing: national security exemption) (inserted by section [88](https://www.legislation.gov.uk/ukpga/2025/18/section/88/2025-09-30) of this Act), in subsection (2)(e), after sub-paragraph (i) insert—
In section 78A (law enforcement processing: national security exemption) (inserted by section [88](https://www.legislation.gov.uk/ukpga/2025/18/section/88/2025-11-17) of this Act), in subsection (2)(e), after sub-paragraph (i) insert—
> (ia) section 119A (standard clauses for transfers to third countries);
@@ -7391,9 +7391,9 @@
##### 26
- (1) Regulations made under section 17A of the 2018 Act (transfers based on adequacy regulations) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 45A of the UK GDPR (inserted by Schedule [7](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/2025-09-30) to this Act).
- (2) In this paragraph, “*the relevant day*” means the day on which paragraph [4](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/paragraph/4/2025-09-30) of Schedule [7](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/2025-09-30) to this Act comes into force.
- (1) Regulations made under section 17A of the 2018 Act (transfers based on adequacy regulations) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 45A of the UK GDPR (inserted by Schedule [7](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/2025-11-17) to this Act).
- (2) In this paragraph, “*the relevant day*” means the day on which paragraph [4](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/paragraph/4/2025-11-17) of Schedule [7](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/2025-11-17) to this Act comes into force.
#### The UK GDPR: transfers subject to appropriate safeguards
@@ -7411,7 +7411,7 @@
- (ii) the requirements of the last sentence of Article 44 of the UK GDPR (level of protection must not be undermined).
- (2) Sub-paragraph [(1)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/27/1/2025-09-30) has effect in addition to Article 46(1A) of the UK GDPR.
- (2) Sub-paragraph [(1)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/27/1/2025-11-17) has effect in addition to Article 46(1A) of the UK GDPR.
- (3) In this paragraph—
@@ -7419,7 +7419,7 @@
- “*personal data*” has the same meaning as in the 2018 Act (see section 3 of that Act);
- “*the relevant day*” means the day on which paragraph [6](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/paragraph/6/2025-09-30) of Schedule [7](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/2025-09-30) to this Act comes into force;
- “*the relevant day*” means the day on which paragraph [6](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/paragraph/6/2025-11-17) of Schedule [7](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/2025-11-17) to this Act comes into force;
- “*third country*” has the same meaning as in Part 3 of the 2018 Act (see section 33 of that Act).
@@ -7427,9 +7427,9 @@
##### 28
- (1) Regulations made under section 17C of the 2018 Act (standard data protection clauses) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 47A(1) of the UK GDPR (inserted by Schedule [7](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/2025-09-30) to this Act).
- (2) In this paragraph, “*the relevant day*” means the day on which paragraph [8](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/paragraph/8/2025-09-30) of Schedule [7](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/2025-09-30) to this Act comes into force.
- (1) Regulations made under section 17C of the 2018 Act (standard data protection clauses) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 47A(1) of the UK GDPR (inserted by Schedule [7](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/2025-11-17) to this Act).
- (2) In this paragraph, “*the relevant day*” means the day on which paragraph [8](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/paragraph/8/2025-11-17) of Schedule [7](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/2025-11-17) to this Act comes into force.
##### 29
@@ -7437,7 +7437,7 @@
- (a) Article 46(1A)(a)(i) of the UK GDPR, or
- (b) [paragraph 27](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/27/2025-09-30)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/27/1/2025-09-30)[(b)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/27/1/b/2025-09-30) of this Schedule.
- (b) [paragraph 27](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/27/2025-11-17)[(1)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/27/1/2025-11-17)[(b)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/27/1/b/2025-11-17) of this Schedule.
- (2) The requirement may be satisfied on and after the relevant day by a version of pre-commencement standard clauses incorporating changes where—
@@ -7445,45 +7445,45 @@
- (b) none of the changes alters the effect of the clauses.
- (3) Changing a reference to regulations under section 17A of the 2018 Act into a reference to regulations made under Article 45A of the UK GDPR is to be treated as a change falling within sub-paragraph [(2)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/29/2/2025-09-30).
- (4) Sub-paragraphs [(2)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/29/2/2025-09-30) and [(3)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/29/3/2025-09-30) cease to apply in relation to pre-commencement standard clauses if—
- (3) Changing a reference to regulations under section 17A of the 2018 Act into a reference to regulations made under Article 45A of the UK GDPR is to be treated as a change falling within sub-paragraph [(2)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/29/2/2025-11-17).
- (4) Sub-paragraphs [(2)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/29/2/2025-11-17) and [(3)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/29/3/2025-11-17) cease to apply in relation to pre-commencement standard clauses if—
- (a) the clauses are specified in regulations and a provision of the regulations relating to the clauses is amended or revoked on or after the relevant day, or
- (b) the clauses are specified in another document and a provision of the document relating to the clauses is amended or withdrawn by the Information Commissioner on or after the relevant day.
- (5) Sub-paragraph [(2)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/29/2/2025-09-30) has effect in addition to Article 46(2) and (3) of the UK GDPR.
- (5) Sub-paragraph [(2)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/29/2/2025-11-17) has effect in addition to Article 46(2) and (3) of the UK GDPR.
- (6) In this paragraph—
- “*pre-commencement standard clauses*” means standard data protection clauses specified in— regulations made under section 17C of the 2018 Act and in force immediately before the relevant day, or a document issued by the Information Commissioner under section 119A of the 2018 Act before the relevant day and not withdrawn before that day;
- “*the relevant day*” means the day on which paragraph [6](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/paragraph/6/2025-09-30) of Schedule [7](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/2025-09-30) to this Act comes into force.
- “*the relevant day*” means the day on which paragraph [6](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/paragraph/6/2025-11-17) of Schedule [7](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/2025-11-17) to this Act comes into force.
#### The UK GDPR: transfers necessary for important reasons of public interest
##### 30
- (1) Regulations made under section 18(1) of the 2018 Act (transfers necessary for important reasons of public interest) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 49(4A) of the UK GDPR (inserted by [Schedule 7](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/2025-09-30) to this Act).
- (2) In this paragraph, “*the relevant day*” means the day on which [paragraph 9](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/paragraph/9/2025-09-30)[(5)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/paragraph/9/5/2025-09-30) of [Schedule 7](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/2025-09-30) to this Act comes into force.
- (1) Regulations made under section 18(1) of the 2018 Act (transfers necessary for important reasons of public interest) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 49(4A) of the UK GDPR (inserted by [Schedule 7](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/2025-11-17) to this Act).
- (2) In this paragraph, “*the relevant day*” means the day on which [paragraph 9](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/paragraph/9/2025-11-17)[(5)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/paragraph/9/5/2025-11-17) of [Schedule 7](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/2025-11-17) to this Act comes into force.
#### The UK GDPR: restrictions on transfers of personal data to third countries and international organisations
##### 31
- (1) Regulations made under section 18(2) of the 2018 Act (restrictions on transfers of personal data to third countries and international organisations) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 49A of the UK GDPR (inserted by Schedule [7](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/2025-09-30) to this Act).
- (2) In this paragraph, “*the relevant day*” means the day on which paragraph [10](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/paragraph/10/2025-09-30) of Schedule [7](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/2025-09-30) to this Act comes into force.
- (1) Regulations made under section 18(2) of the 2018 Act (restrictions on transfers of personal data to third countries and international organisations) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 49A of the UK GDPR (inserted by Schedule [7](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/2025-11-17) to this Act).
- (2) In this paragraph, “*the relevant day*” means the day on which paragraph [10](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/paragraph/10/2025-11-17) of Schedule [7](https://www.legislation.gov.uk/ukpga/2025/18/schedule/7/2025-11-17) to this Act comes into force.
#### Part 3 of the 2018 Act (law enforcement processing): transfers approved by regulations
##### 32
- (1) Regulations made under section 74A of the 2018 Act (transfers based on adequacy regulations) and in force immediately before the relevant day are to be treated, on and after that day, as if made under section [74AA](#p19204) of that Act (inserted by Schedule [8](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/2025-09-30) to this Act).
- (2) In this paragraph, “*the relevant day*” means the day on which paragraph [4](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/4/2025-09-30) of Schedule [8](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/2025-09-30) to this Act comes into force.
- (1) Regulations made under section 74A of the 2018 Act (transfers based on adequacy regulations) and in force immediately before the relevant day are to be treated, on and after that day, as if made under section [74AA](#p19204) of that Act (inserted by Schedule [8](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/2025-11-17) to this Act).
- (2) In this paragraph, “*the relevant day*” means the day on which paragraph [4](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/4/2025-11-17) of Schedule [8](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/2025-11-17) to this Act comes into force.
#### Part 3 of the 2018 Act (law enforcement processing): transfers subject to appropriate safeguards
@@ -7495,9 +7495,9 @@
- (b) if the transfer had been made immediately before the relevant day, the requirement in section 75(1)(a) of the 2018 Act (binding legal instrument containing appropriate safeguards) would have been satisfied by virtue of that instrument.
- (2) Sub-paragraph [(1)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/33/1/2025-09-30) has effect in addition to section 75[(1A)](#p19472) of the 2018 Act.
- (3) For the purposes of sub-paragraph [(1)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/33/1/2025-09-30), a legal instrument is an “*appropriate pre-commencement legal instrument*”, in relation to a transfer of personal data, if—
- (2) Sub-paragraph [(1)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/33/1/2025-11-17) has effect in addition to section 75[(1A)](#p19472) of the 2018 Act.
- (3) For the purposes of sub-paragraph [(1)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/33/1/2025-11-17), a legal instrument is an “*appropriate pre-commencement legal instrument*”, in relation to a transfer of personal data, if—
- (a) it was entered into before the relevant day,
@@ -7513,7 +7513,7 @@
- “*personal data*” has the same meaning as in the 2018 Act (see section 3 of that Act);
- “*the relevant day*” means the day on which paragraph [6](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/6/2025-09-30) of Schedule [8](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/2025-09-30) to this Act comes into force;
- “*the relevant day*” means the day on which paragraph [6](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/6/2025-11-17) of Schedule [8](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/2025-11-17) to this Act comes into force;
- “*third country*” has the same meaning as in Part 3 of the 2018 Act (see section 33 of that Act).
@@ -7589,7 +7589,7 @@
##### 9
In section 26(2)(f) (national security and defence exemption), omit sub-paragraph (ai) (inserted by [section 88](https://www.legislation.gov.uk/ukpga/2025/18/section/88/2025-09-30) of this Act).
In section 26(2)(f) (national security and defence exemption), omit sub-paragraph (ai) (inserted by [section 88](https://www.legislation.gov.uk/ukpga/2025/18/section/88/2025-11-17) of this Act).
##### 10
@@ -7641,7 +7641,7 @@
##### 12
In section 45A (exemption from sections 44 and 45: legal professional privilege) (inserted by section [79](https://www.legislation.gov.uk/ukpga/2025/18/section/79/2025-09-30) of this Act), in subsection (2), after paragraph (c) insert—
In section 45A (exemption from sections 44 and 45: legal professional privilege) (inserted by section [79](https://www.legislation.gov.uk/ukpga/2025/18/section/79/2025-11-17) of this Act), in subsection (2), after paragraph (c) insert—
> (ca) the data subject’s right to make a complaint to the controller under section [164A](#p12626),
@@ -8159,7 +8159,7 @@
- (1) This paragraph applies to the person who holds the office of Information Commissioner immediately before the day on which this Schedule comes into force.
- (2) The person is to be treated as having been appointed as the chair of the Information Commission for a term that expires at the time the person would cease to hold the office of Information Commissioner but for the abolition of that office by section [118](https://www.legislation.gov.uk/ukpga/2025/18/section/118/2025-09-30).
- (2) The person is to be treated as having been appointed as the chair of the Information Commission for a term that expires at the time the person would cease to hold the office of Information Commissioner but for the abolition of that office by section [118](https://www.legislation.gov.uk/ukpga/2025/18/section/118/2025-11-17).
- (3) For the purposes of paragraph [7](#p22452)[(3)](#p22461) of Schedule [12A](#p22271) to the Data Protection Act 2018 (extension of chair’s term), the term of the person’s appointment as chair of the Information Commission is to be treated as a term beginning when the person began to hold the office of Information Commissioner.
@@ -8493,7 +8493,7 @@
#### Related subordinate legislation
#### Other defined terms
#### Repeal of provisions relating to supply of customer data
#### Index of defined terms for this Part
@@ -8753,16 +8753,16 @@
In the UK GDPR, at the end insert—
In the UK GDPR, after Annex 1 (inserted by [Schedule 4](https://www.legislation.gov.uk/ukpga/2025/18/schedule/4/2025-09-30) to this Act) insert—
In the UK GDPR, after Annex 1 (inserted by [Schedule 4](https://www.legislation.gov.uk/ukpga/2025/18/schedule/4/2025-11-17) to this Act) insert—
#### The UK GDPR
#### The 2018 Act
#### General principles for transfers
#### Introduction
#### Introduction
#### Overview and interpretation
#### General principles for transfer
@@ -9627,7 +9627,11 @@
[^key-19eedac5989e030312e6dd22c77a756c]: [S. 124](https://www.legislation.gov.uk/ukpga/2025/18/section/124) in force at 30.9.2025 in so far as not already in force by [S.I. 2025/982](https://www.legislation.gov.uk/uksi/2025/982), [reg. 2](https://www.legislation.gov.uk/uksi/2025/982/regulation/2)
#### The UK GDPR
[^key-d557bcf446f4d51be8349fb1e239ad26]: [S. 89](https://www.legislation.gov.uk/ukpga/2025/18/section/89) in force at 17.11.2025 in so far as not already in force by [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/a)
[^key-024d5fbcb53dd74c669c532a9a90962d]: [S. 90](https://www.legislation.gov.uk/ukpga/2025/18/section/90) in force at 17.11.2025 by [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
#### The 2018 Act
In the PEC Regulations, before Schedule 1 insert—
2025-09-30
Data (Use and Access) Act 2025
2025-09-05
Data (Use and Access) Act 2025
2025-08-20
Data (Use and Access) Act 2025
2025-08-19
Data (Use and Access) Act 2025
2025-06-19
Data (Use and Access) Act 2025
original version
Text at this date