Back to Frameworks

Data (Use and Access) Act 2025

Self-Assess
United Kingdom
vData (Use and Access) Act 2025 (c. 18); revised text valid 19 June 2026, commencement read to Commencement No. 9 (S.I. 2026/1015)
7 domains
38 controls

The United Kingdom's Data (Use and Access) Act 2025 as an amending Act: the duties it places on organisations in its own right (smart data schemes, digital verification services, the National Underground Asset Register, registration equipment, the PECR cookie, soft opt-in, breach and enforcement changes, health IT standards, online-safety retention), each with its commencement status, and short pointers to the UK GDPR and Data Protection Act 2018 duties it amended, with the Information Commission taking over on 30 September 2026.

Verified

Data (Use and Access) Act 2025 is a compliance framework from United Kingdom with 7 domains and 38 controls that map to 2 other frameworks. The largest domains are Part 5 Chapter 1: Data protection amendments (pointers to the amended UK GDPR and Data Protection Act 2018) – Data (Use and Access) Act 2025 (16 controls), Part 1: Access to customer data and business data (smart data schemes) – Data (Use and Access) Act 2025 (5 controls), Part 2: Digital verification services – Data (Use and Access) Act 2025 (5 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (7)

Part 1: Access to customer data and business data (smart data schemes) – Data (Use and Access) Act 2025

5 controls
Controls in the Part 1: Access to customer data and business data (smart data schemes) – Data (Use and Access) Act 2025 domain of Data (Use and Access) Act 2025: 5 controls
CodeTitle
data-use-and-access-act-2025::s.2-3Sections 2 and 3: Data holders' duties for customer data under data regulations
data-use-and-access-act-2025::s.3(7)-6Sections 3, 5 and 6: Authorised persons and third party recipients
data-use-and-access-act-2025::s.4-5Sections 4 and 5: Data holders' duties for business data under data regulations
data-use-and-access-act-2025::s.7-14Sections 7 and 14 to 16: Interface bodies and FCA interface rules
data-use-and-access-act-2025::s.8-12Sections 8 to 12: Enforcement, penalties, fees and levies under data regulations

Part 2: Digital verification services – Data (Use and Access) Act 2025

5 controls
Controls in the Part 2: Digital verification services – Data (Use and Access) Act 2025 domain of Data (Use and Access) Act 2025: 5 controls
CodeTitle
data-use-and-access-act-2025::s.28-44Sections 40 to 44: Continued conformity with the DVS trust framework and supplementary codes
data-use-and-access-act-2025::s.33-39Sections 33 to 39: Registration on the DVS register
data-use-and-access-act-2025::s.45-49Sections 45 to 49: Information gateway, onward disclosure limits and the disclosure code
data-use-and-access-act-2025::s.50Section 50: Use of the DVS trust mark
data-use-and-access-act-2025::s.51Section 51: Information notices from the Secretary of State to DVS providers and assessment bodies

Part 3: National Underground Asset Register and street works records – Data (Use and Access) Act 2025

4 controls
Controls in the Part 3: National Underground Asset Register and street works records – Data (Use and Access) Act 2025 domain of Data (Use and Access) Act 2025: 4 controls
CodeTitle
data-use-and-access-act-2025::NRSWA.106BSection 56: Initial upload of apparatus records into NUAR
data-use-and-access-act-2025::NRSWA.106ESection 56 and Schedule 1: NUAR fees, fee information and penalties
data-use-and-access-act-2025::NRSWA.79Section 57: Recording apparatus information and keeping NUAR current
data-use-and-access-act-2025::NRSWA.80Section 57: Reporting missing or incorrect apparatus information found during works

Part 4: Registers of births and deaths – Data (Use and Access) Act 2025

1 controls
Controls in the Part 4: Registers of births and deaths – Data (Use and Access) Act 2025 domain of Data (Use and Access) Act 2025: 1 controls
CodeTitle
data-use-and-access-act-2025::s.62Section 62: Local authority equipment and facilities for electronic registration

Part 5 Chapter 1: Data protection amendments (pointers to the amended UK GDPR and Data Protection Act 2018) – Data (Use and Access) Act 2025

16 controls
Controls in the Part 5 Chapter 1: Data protection amendments (pointers to the amended UK GDPR and Data Protection Act 2018) – Data (Use and Access) Act 2025 domain of Data (Use and Access) Act 2025: 16 controls
CodeTitle
data-use-and-access-act-2025::s.103Section 103 and Schedule 10: Complaints by data subjects to controllers (2018 Act section 164A)
data-use-and-access-act-2025::s.69Section 69: Conditions for consent to law enforcement processing (2018 Act section 40A)
data-use-and-access-act-2025::s.70Section 70 and Schedule 4: Recognised legitimate interests and relevant international law (UK GDPR Article 6)
data-use-and-access-act-2025::s.71Section 71 and Schedule 5: Purpose limitation and further processing (UK GDPR Articles 5 and 8A)
data-use-and-access-act-2025::s.73Section 73: Elected representatives' processing after an election (2018 Act Schedule 1 paragraph 23)
data-use-and-access-act-2025::s.75Section 75: Reasons for refusing law enforcement requests and fee guidance (2018 Act section 53)
data-use-and-access-act-2025::s.76Section 76: Time limits for responding to data subjects' requests (UK GDPR Article 12A)
data-use-and-access-act-2025::s.77Section 77: Transparency exemption for research further processing and disproportionate effort (UK GDPR Articles 13 and 14)
data-use-and-access-act-2025::s.78Section 78: Reasonable and proportionate searches for access requests (UK GDPR Article 15(1A))
data-use-and-access-act-2025::s.79Section 79: Legal professional privilege exemption for law enforcement information and access (2018 Act section 45A)
data-use-and-access-act-2025::s.80Section 80 and Schedule 6: Automated decision-making (UK GDPR Articles 22A to 22D)
data-use-and-access-act-2025::s.81Section 81: Children's higher protection matters in data protection by design (UK GDPR Article 25(1A))
data-use-and-access-act-2025::s.82Section 82: Logging of law enforcement processing (2018 Act section 62)
data-use-and-access-act-2025::s.85Section 85 and Schedules 7 to 9: International transfers and the data protection test (UK GDPR Chapter 5)
data-use-and-access-act-2025::s.86Sections 67, 68, 86 and 87: Research definitions, broad consent and research safeguards (UK GDPR Chapter 8A)
data-use-and-access-act-2025::s.96-100Sections 96 to 98 and 100: Commissioner's notices, documents, approved-person reports and interview notices (2018 Act Part 6)

Part 5 Chapter 2: Privacy and electronic communications (PEC Regulations 2003) – Data (Use and Access) Act 2025

5 controls
Controls in the Part 5 Chapter 2: Privacy and electronic communications (PEC Regulations 2003) – Data (Use and Access) Act 2025 domain of Data (Use and Access) Act 2025: 5 controls
CodeTitle
data-use-and-access-act-2025::PECR.22Section 114: Charity soft opt-in for email marketing (regulation 22(3A))
data-use-and-access-act-2025::PECR.31Section 115 and Schedule 13: PECR enforcement notices and fines at UK GDPR levels
data-use-and-access-act-2025::PECR.5ASection 111: PECR personal data breach notification within 72 hours (regulation 5A)
data-use-and-access-act-2025::PECR.6Section 112: Storage of and access to information in terminal equipment (cookies and similar technologies)
data-use-and-access-act-2025::PECR.A1Schedule 12: Consent exemptions for strictly necessary, statistical, appearance and emergency purposes

Part 7: Other provision about use of, or access to, data – Data (Use and Access) Act 2025

2 controls
Controls in the Part 7: Other provision about use of, or access to, data – Data (Use and Access) Act 2025 domain of Data (Use and Access) Act 2025: 2 controls
CodeTitle
data-use-and-access-act-2025::s.121Section 121 and Schedule 15: Information standards for IT suppliers to health and adult social care in England
data-use-and-access-act-2025::s.124Section 124: Retaining information after the death of a child (Online Safety Act 2023)

Maps to 2 other frameworks

56 total controls
GDPR
4 source controls mapped|4 target controls covered
7%
ISO 27701:2019
1 source controls mapped|1 target controls covered
2%
Compare Data (Use and Access) Act 2025 with GDPR

Coverage is not the same as your position

This page shows what Data (Use and Access) Act 2025 overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is Data (Use and Access) Act 2025 and who does it apply to?

Data (Use and Access) Act 2025 is a compliance framework from United Kingdom with 7 domains and 38 controls. The United Kingdom's Data (Use and Access) Act 2025 as an amending Act: the duties it places on organisations in its own right (smart data schemes, digital verification services, the National Underground Asset Register, registration equipment, the PECR cookie, soft opt-in, breach and enforcement changes, health IT standards, online-safety retention), each with its commencement status, and short pointers to the UK GDPR and Data Protection Act 2018 duties it amended, with the Information Commission taking over on 30 September 2026. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does Data (Use and Access) Act 2025 actually require?

Data (Use and Access) Act 2025 has 38 controls organised across 7 domains. The largest domains are Part 5 Chapter 1: Data protection amendments (pointers to the amended UK GDPR and Data Protection Act 2018) – Data (Use and Access) Act 2025 (16 controls), Part 1: Access to customer data and business data (smart data schemes) – Data (Use and Access) Act 2025 (5 controls), Part 2: Digital verification services – Data (Use and Access) Act 2025 (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of Data (Use and Access) Act 2025 do I already cover?

Data (Use and Access) Act 2025 maps to 2 other compliance frameworks. The top mapping partners are GDPR (7% coverage), ISO 27701:2019 (2% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement Data (Use and Access) Act 2025?

Start your Data (Use and Access) Act 2025 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Data (Use and Access) Act 2025 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 38 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,121 frameworks.

Get Started Free →

Free forever, no credit card required