lexiara

DUAA 2025 — Data (Use and Access) Act 2025

law · United Kingdom · ukpga/2025/18

1699 provisions

Defined terms · All instruments

1 Customer data and business data
1
2
3
4
5
6
2 Power to make provision in connection with customer data
1
2
3
4
5
3 Customer data: supplementary
1
2
3
4
5
6
7
8
9
10
11
4 Power to make provision in connection with business data
1
2
3
4
5
5 Business data: supplementary
1
2
3
4
5
6
7
8
9
10
11
6 Decision-makers
1
2
3
4
5
6
7
8
9
10
11
12
7 Interface bodies
1
2
3
4
5
6
7
8 Enforcement of regulations under this Part
1
2
3
4
5
6
7
8
9
10
11
12
13
9 Restrictions on powers of investigation etc
1
2
3
4
5
6
7
8
9
10 Financial penalties
1
2
3
4
11 Fees
1
2
3
4
5
6
7
8
9
10
11
12 Levy
1
2
3
4
5
6
13 Financial assistance
1
2
3
4
5
14 The FCA and financial services interfaces
1
2
3
4
5
6
7
8
9
10
15 The FCA and financial services interfaces: supplementary
1
2
3
4
5
6
7
8
9
10
11
12
13
14
16 The FCA and financial services interfaces: penalties and levies
1
2
3
4
5
6
7
17 The FCA and co-ordination with other regulators
18 Liability in damages
1
2
3
19 Duty to review regulations
1
2
3
4
5
6
7
8
9
20 Restrictions on processing and data protection
1
2
3
21 Regulations under this Part: supplementary
1
2
3
4
5
22 Regulations under this Part: Parliamentary procedure and consultation
1
2
3
4
23 Related subordinate legislation
1
2
3
4
5
24 Repeal of provisions relating to supply of customer data
25 Other defined terms
1
2
3
4
26 Index of defined terms for this Part
27 Introductory
1
2
3
28 DVS trust framework
1
2
3
4
5
6
7
8
9
10
29 Supplementary codes
1
2
3
4
5
6
7
8
9
10
11
30 Withdrawal of a supplementary code
1
2
31 Review of DVS trust framework and supplementary codes
1
2
32 DVS register
1
2
3
33 Registration in the DVS register
1
2
3
4
5
6
7
34 Power to refuse registration in the DVS register
1
2
3
4
5
6
7
8
9
10
11
35 Registration of additional services
1
2
3
4
36 Supplementary notes
1
2
3
4
5
6
37 Addition of services to supplementary notes
1
2
3
4
5
38 Applications for registration, supplementary notes, etc
1
2
3
4
5
39 Fees for applications for registration, supplementary notes, etc
1
2
3
4
5
6
7
8
40 Duty to remove person from the DVS register
1
2
41 Power to remove person from the DVS register
1
2
3
4
5
6
7
8
9
10
11
42 Duty to remove services from the DVS register
1
2
3
43 Duty to remove supplementary notes from the DVS register
1
2
44 Duty to remove services from supplementary notes
1
2
3
45 Power of public authority to disclose information to registered person
1
2
3
4
5
6
7
8
46 Information disclosed by the Revenue and Customs
1
2
3
4
5
47 Information disclosed by the Welsh Revenue Authority
1
2
3
4
5
6
7
48 Information disclosed by Revenue Scotland
1
2
3
4
5
6
7
49 Code of practice about the disclosure of information
1
2
3
4
5
6
7
8
9
10
11
50 Trust mark for use by registered persons
1
2
3
4
51 Power of Secretary of State to require information
1
2
3
4
5
6
7
8
9
10
11
12
52 Arrangements for third party to exercise functions
1
2
3
4
5
53 Report on the operation of this Part
1
2
3
54 Index of defined terms for this Part
55 Powers relating to verification of identity or status
1
2
3
56 National Underground Asset Register: England and Wales
1
2
3
4
57 Information in relation to apparatus: England and Wales
1
2
3
4
5
6
7
8
58 National Underground Asset Register: Northern Ireland
1
2
3
4
5
6
59 Information in relation to apparatus: Northern Ireland
1
2
3
4
5
6
7
60 Pre-commencement consultation
1
2
106A National Underground Asset Register
1
2
3
4
5
6
106B Initial upload of information into NUAR
1
2
3
4
5
6
7
8
9
106C Access to information kept in NUAR
1
2
3
4
5
106D Guidance
1
2
3
4
5
106E Fees payable by undertakers in relation to NUAR
1
2
3
4
5
6
7
8
9
10
106F Providing information for purposes of regulations under section 106E
1
2
3
4
5
106G Monetary penalties
106H Arrangements for third party to exercise functions
1
2
3
4
5
6
7
8
9
106I Data protection
1
2
106J Regulations under this Part
1
2
3
4
5
6
7
106K Interpretation
1
2
61 Form in which registers of births and deaths are to be kept
1
2
3
62 Provision of equipment and facilities by local authorities
1
2
63 Requirements to sign register
1
2
3
64 Treatment of existing registers and records
1
2
3
4
5
6
7
65 Minor and consequential amendments
66 The 2018 Act and the UK GDPR
67 Meaning of research and statistical purposes
1
2
68 Consent to processing for the purposes of scientific research
1
2
3
69 Consent to law enforcement processing
1
2
3
4
5
70 Lawfulness of processing
1
2
3
4
5
6
7
8
9
71 The purpose limitation
1
2
3
4
5
6
7
8
9
10
72 Processing in reliance on relevant international law
1
2
3
4
5
6
7
8
73 Elected representatives responding to requests
74 Processing of special categories of personal data
1
2
3
4
5
6
7
8
9
10
11
12
13
75 Fees and reasons for responses to data subjects’ requests about law enforcement processing
1
2
3
76 Time limits for responding to data subjects’ requests
1
2
3
4
5
6
7
77 Information to be provided to data subjects
1
2
78 Searches in response to data subjects’ requests
1
2
3
4
5
79 Data subjects’ rights to information: legal professional privilege exemption
1
2
3
4
5
6
7
80 Automated decision-making
1
2
3
4
5
6
81 Data protection by design: children’s higher protection matters
1
2
3
4
82 Logging of law enforcement processing
83 General processing and codes of conduct
4A
84 Law enforcement processing and codes of conduct
1
2
3
4
5
6
85 Transfers of personal data to third countries and international organisations
1
2
3
86 Safeguards for processing for research etc purposes
1
2
3
4
5
6
7
87 Section 86: consequential provision
1
2
3
88 National security exemption
1
2
3
4
5
6
7
8
9
10
11
12
89 Joint processing by intelligence services and competent authorities
1
2
3
90 Joint processing: consequential amendments
1
2
3
4
5
6
7
8
9
10
91 Duties of the Commissioner in carrying out functions
1
2
3
4
5
92 Codes of practice for the processing of personal data
1
2
3
4
5
6
7
8
9
93 Codes of practice: panels and impact assessments
1
2
3
4
5
6
7
8
9
10
11
12
1
2
94 Manifestly unfounded or excessive requests to the Commissioner
1
2
3
4
95 Analysis of performance
1
2
3
96 Notices from the Commissioner
1
2
3
4
97 Power of the Commissioner to require documents
1
2
3
4
5
6
7
98 Power of the Commissioner to require a report
1
2
3
4
5
99 Assessment notices: removal of OFSTED restriction
100 Interview notices
1
2
3
4
5
6
7
8
9
10
11
12
101 Penalty notices
1
2
3
4
102 Annual report on regulatory action
1
2
3
4
103 Complaints by data subjects
1
2
3
4
5
6
7
104 Court procedure in connection with subject access requests
1
2
3
105 Consequential amendments to the EITSET Regulations
1
2
3
4
5
6
7
8
9
10
106 Protection of prohibitions, restrictions and data subject’s rights
1
2
3
4
5
6
7
107 Regulations under the UK GDPR
1
2
108 Further minor provision about data protection
109 The PEC Regulations
110 Interpretation of the PEC Regulations
1
2
3
4
5
111 Duty to notify the Commissioner of personal data breach: time periods
1
2
3
112 Storing information in the terminal equipment of a subscriber or user
1
2
3
4
5
113 Emergency alerts: interpretation of time periods
114 Use of electronic mail for direct marketing by charities
1
2
3
4
115 Commissioner’s enforcement powers
1
2
3
4
5
6
7
8
9
10
116 Codes of conduct
1
2
3
4
117 The Information Commission
1
2
3
4
5
6
118 Abolition of the office of Information Commissioner
1
2
3
4
5
6
7
119 Transfer of functions to the Information Commission
1
2
3
120 Transfer of property etc to the Information Commission
1
2
3
4
5
121 Information standards for health and adult social care in England
122 Grant of smart meter communication licences
123 Disclosure of information to improve public service delivery to undertakings
1
2
3
4
124 Retention of information by providers of internet services in connection with death of child
1
2
3
4
5
6
7
8
9
10
11
125 Information for research about online safety matters
1
2
3
4
5
126 Retention of biometric data and recordable offences
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
127 Retention of pseudonymised biometric data
1
2
3
4
5
6
7
8
9
10
11
12
13
128 Retention of biometric data from INTERPOL
1
2
3
4
5
6
7
8
129 The eIDAS Regulation
130 Recognition of EU conformity assessment bodies
131 Removal of recognition of EU standards etc
1
2
3
4
5
6
7
132 Recognition of overseas trust products
1
2
3
133 Co-operation between supervisory authority and overseas authorities
1
2
3
4
5
134 Time periods: the eIDAS Regulation and the EITSET Regulations
1
2
3
4
135 Economic impact assessment
1
2
3
4
136 Report on the use of copyright works in the development of AI systems
1
2
3
4
5
6
7
8
9
137 Progress statement
1
2
138 Creating, or requesting the creation of, purported intimate image of adult
1
2
3
4
5
6
139 Power to make consequential amendments
1
2
3
4
5
6
7
140 Regulations
1
2
3
4
141 Extent
1
2
3
4
5
6
7
8
9
10
11
142 Commencement
1
2
3
4
5
143 Transitional, transitory and saving provision
1
2
3
4
144 Short title
1 Power to impose monetary penalties
1
2
3
4
5
2 Warning notices
1
2
3
3 Penalty notices
1
2
3
4
5
6
4 Enforcement
5 Appeals
1
2
3
4
5
6
7
8
9
1 Power to impose monetary penaltiesamen
1
2
3
4
2 Warning notices
1
2
3
3 Penalty notices
1
2
3
4
5
6
4 Enforcement
5 Appeals
1
2
3
4
5
6
7
8
9
1
2
1
2
3
3
1
2
3
4
5
4
5
1
2
3
4
5
6
6
7
1
2
3
4
8
1
1A
9
1
2
10
1
2
3
4
11
12
13
1
2
3
14
15
16
4
17 Registration Service Act 1953
18 Registration Service Act 1953
19 Registration Service Act 1953
20 Registration Service Act 1953
21 Public Records Act 1958
22 Social Security Administration Act 1992
6
23 Education Act 1996
1
2
3
4
24 Adoption and Children Act 2002
25 Gender Recognition Act 2004
26 Gender Recognition Act 2004
1
2
3
27 Gender Recognition Act 2004
28 Presumption of Death Act 2013
1 The UK GDPR
10 The 2018 Act
2
1
2
3
4
5
6
3
4
5
6
7
8
9
11
12
13
1
2
3
4
5
6
14
1
2
3
15
16
1 Introduction
2 General principles for transfers
1
2
3 Transfers approved by regulations
5 Transfers approved by regulations: monitoring
1
2
3
4
5
6 Transfers subject to appropriate safeguards
1
2
3
4
5
6
9 Derogations for specific situations
1
2
3
4
5
6
7
10 Public interest restrictions
1
2
3
4
1
2
3
4
5
1
2
3
4
7
8
1
2
3
4
5
6
7
8
1 Introduction
2 Overview and interpretation
3 General principles for transfer
1
2
3
4
5
6
4 Transfers approved by regulations
1
2
5 Transfers approved by regulations: monitoring
1
2
3
4
5
6
7
8
9
6 Transfers subject to appropriate safeguards
1
2
3
4
5
6
7
7 Transfers based on special circumstances
1
2
3
4
5
6
7
8 Transfers to particular recipients
10 Subsequent transfers
1
2
3
4
5
6
7
8
9
10
9
1
2
3
4
1 The UK GDPR
11 The 2018 Act
2
3
4
5
1
2
3
6
7
8
9
10
12
13
14
15
16
17
18
8
19
20
1
2
3
21
22
1
2
3
4
5
6
7
8
23
24
25
1
2
3
4
5
6
7
8
9
26 The UK GDPR: transfers approved by regulations
1
2
27 The UK GDPR: transfers subject to appropriate safeguards
1
2
3
28 The UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses
1
2
30 The UK GDPR: transfers necessary for important reasons of public interest
1
2
31 The UK GDPR: restrictions on transfers of personal data to third countries and international organisations
1
2
32 Part 3 of the 2018 Act (law enforcement processing): transfers approved by regulations
1
2
33 Part 3 of the 2018 Act (law enforcement processing): transfers subject to appropriate safeguards
1
2
3
4
29
1
2
3
4
5
6
1 The UK GDPR
2 The UK GDPR
3 The UK GDPR
1
2
3
4 The UK GDPR
1
2
3
5 The UK GDPR
1
2
3
6 The UK GDPR
7 The UK GDPR
1
2
3
8 The 2018 Act
9 The 2018 Act
10 The 2018 Act
1
2
3
11 The 2018 Act
1
2
3
12 The 2018 Act
13 The 2018 Act
1
2
3
14 The 2018 Act
15 The 2018 Act
16 The 2018 Act
1
2
3
4
17 The 2018 Act
18 The 2018 Act
4A
19 The 2018 Act
20 The 2018 Act
1
2
3
21 The 2018 Act
1
2
3
1 The UK GDPR
2 The UK GDPR
1
2
3
3 The UK GDPR
1
2
4 The UK GDPR
5 The UK GDPR
6 The UK GDPR
7 The UK GDPR
8 The UK GDPR
9 The UK GDPR
10 The UK GDPR
11 The UK GDPR
12 The UK GDPR
13 The 2018 Act
32 Victims and Prisoners Act 2024
14
15
16
17
18
19
1
2
3
4
20
21
22
23
1
2
3
24
25
26
27
28
1
2
3
4
5
6
29
1
2
3
30
31
1 Interpretation
1
2
2 Consent
1
2
3
3 Transmission of a communication over an electronic communications network
4 Storage or access strictly necessary to provide an information society service
1
2
5 Collecting information for statistical purposes
1
2
3
6 Website appearance etc
1
2
7 Emergency assistance
1 Provisions applied for enforcement purposes
2 General modification of references to the Data Protection Act 2018
3 Modification of section 142 (information notices)
8A
8B
8C
4 Modification of section 143 (information notices: restrictions)
1
2
5 Modification of section 145 (information orders)
6 Modification of section 146 (assessment notices)
1A
7 Modification of section 146A (assessment notices: approval of person to prepare report)
8 Modification of section 147 (assessment notices: restrictions)
1
2
9 Modification of section 148A (interview notices)
10 Modification of section 148B (interview notices: restrictions)
1
2
11 Modification of section 149 (enforcement notices)
1
2
12 Modification of section 150 (enforcement notices: supplementary)
1
2
13 Modification of section 152 (enforcement notices: restrictions)
14 Modification of Schedule 15 (powers of entry and inspection)
1
2
3
4
5
15 Modification of section 155 (penalty notices)
1A
2
4A
4B
16 Modification of Schedule 16 (penalties)
17 Modification of section 156 (penalty notices: restrictions)
1
2
18 Modification of section 157 (maximum amount of penalty)
4B
19 Modification of section 159 (amount of penalties: supplementary)
20 Modification of section 160 (guidance)
21 Modification of section 162 (rights of appeal)
22 Modification of section 163 (determination of appeals)
23 Modification of section 180 (jurisdiction)
1
2
24 Modification of section 181 (interpretation of Part 6)
25 Modification of section 182 (regulations and consultation)
1
2
26 Modification of section 196 (penalties for offences)
1
2
27 Modification of section 200 (guidance about PACE codes of practice)
28 Modification of section 202 (proceedings in the First-tier Tribunal: contempt)
29 Modification of section 203 (tribunal procedure rules)
30 Interpretation
1 Schedule 12A to the Data Protection Act 2018
1
2
1
2
3
4
1
2
3
4
5
6
7
8
1
2
1
2
3
4
5
1
2
3
4
5
6
7
1
2
3
1
2
3
4
5
6
7
8
9
1
2
3
1
2
3
1
2
3
4
1
2
3
4
1
2
3
4
5
6
1
2
3
4
5
1
2
3
4
5
6
7
8
9
1
2
1
2
3
1
2
3
4
5
6
1
2
3
1
2
3
4
5
6
7
2 Transitional provision: first chair
1
2
3
3 Transitional provision: consultation about non-executive members
1
2
4 Transitional provision: consultation about interim chief executive
1
2
1
2
3
1
2
3
4
5
6
4
1
2
3
5
1
2
3
6
7
8
1
2
3
1
2
3
4
5
6
1
2
3
4
5
1
2
3
4
1
2
3
1
2
3
4
5
1
2
3
4
5
1
2
3
4
5
6
7
1
2
3
4
4
5 Gas Act 1986
1
2
3
6 Electricity Act 1989
1
2
3
7 Electricity and Gas (Competitive Tenders for Smart Meter Communication Licences) Regulations 2012