Data (Use and Access) Act 2025
Data (Use and Access) Act 2025 (2025 c. 18)
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and is commencing in stages. Part 2, in force from 1 December 2025 (except sections 45 to 48), puts the UK digital verification services trust framework and register on a statutory footing. Most amendments to the UK GDPR, Data Protection Act 2018 and PECR commenced on 5 February 2026, and the ICO became the Information Commission on 30 September 2026.
Who it applies to
Providers of digital identity and attribute services that choose to register against the statutory trust framework, and every organization subject to the UK GDPR, the Data Protection Act 2018 or PECR.
Identity requirements
- Digital verification service providers that want to be on the government register must be certified against the DVS trust framework by an accredited conformity assessment body
- Registered providers can display a trust mark, and the Act enables public authorities to share information with them for identity checks once sections 45 to 48 commence
- Automated decisions with significant effects are permitted on more lawful bases, but individuals must be told, be able to contest the decision and obtain human intervention; special category data stays restricted
- Recognised legitimate interests (such as crime prevention and safeguarding) can be relied on without a balancing test
- Controllers must have a process for handling data protection complaints (from 19 June 2026)
- PECR fines rise to UK GDPR levels and cookie consent exemptions widen
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Identity verification (KYC/proofing) | Creates a statutory register and trust mark for identity verification providers used for right-to-work, right-to-rent and age checks. |
| Customer identity & consent (CIAM) | Cookie consent exemptions and recognised legitimate interests change consent design in UK customer journeys. |
| Audit, logging & accountability | Automated identity decisions such as fraud declines need documented safeguards and a route to human review. |
Penalties
Fines for PECR breaches rise to the UK GDPR maximum of 17.5 million pounds or 4 percent of worldwide annual turnover, whichever is higher. Providers that breach trust framework conditions can be removed from the DVS register.
Status and dates last verified against primary sources on 2026-10-31.
Data (Use and Access) Act 2025: frequently asked questions
- Does the Data (Use and Access) Act create a UK digital ID?
- No. It creates a statutory trust framework, register and trust mark for private and public digital verification services. It does not create a national ID card or require anyone to use digital identity.
- When do the Act's data protection changes apply?
- In stages. Most UK GDPR and Data Protection Act 2018 changes commenced on 5 February 2026, the complaints-handling duty on 19 June 2026, and the ICO's restructuring into the Information Commission on 30 September 2026.
- Who runs the UK digital verification services register?
- The Department for Science, Innovation and Technology, through its Office for Digital Identities and Attributes (OfDIA), maintains the trust framework and the register of certified digital verification services.