Understanding the UK’s new Data Act - Yoti

The Data (Use and Access) Act, now known more simply as the “Data Act”, is a landmark piece of UK legislation that aims to reshape how individuals and businesses interact with digital data. It introduces provisions for a national digital identity trust framework, helping to foster trust in digital identities by ensuring that businesses adhere to strict standards during digital transactions.

This blog gives an overview of the Data Act and what this means for digital identities in the UK.

Why has the Government introduced the Data Act?

The Government has said that the Act will “unlock the power of data to grow the economy and improve people’s lives.”

This includes the creation and adoption of secure digital identities to help with everyday tasks, including buying age-restricted goods and services, completing employment checks, opening bank accounts and moving house.

Empowering people with secure digital identities will improve efficiencies, create positive customer experiences and reduce fraud. The Government predicts that these new provisions could boost the UK economy by £10 billion thanks to their significant potential to improve public services and drive economic growth in the UK.

The Data Act had initially been announced in the 2024 King’s Speech as the Digital Information and Smart Data Bill ( DISD). The previous Government’s version was known as the Data Protection and Digital Information Bill ( DPDI).

What does the Data Act include?

• establishing a framework for the provision of digital verification services to enable digital identities to be used with the same confidence as paper documents.
• amending the Privacy and Electronic Communications Regulations (PECR) to further deter against fraudulent and unsolicited communications.
• allowing consumers to securely share their personal data with authorised third parties to provide services such as personalised market comparisons and account management.
• making provisions to allow for information sharing during independent research into online safety matters.
• making it an offence to ask someone to create a fake intimate image of another person without their consent, regardless of whether the image is ever created. This applies whether the request is made directly to an individual or if the request is made publicly, such as in a group chat or online, even if it isn’t directed at anyone specific.
• modernising the way births and deaths are registered in England and Wales, enabling the move from a paper-based system to an electronic register.
• facilitating the flow and use of personal data for law enforcement and national security purposes.
• creating a clearer legal basis for political parties and elected representatives to process personal data for the purposes of democratic engagement.
• transforming the Information Commissioner’s Office (ICO).
• improving data laws to increase clarity and encourage the safe development of new technologies.

What are the main digital identity aspects of the Data Act?

A key part of the Data Act aims to bring digital identity to more people by establishing the UK’s digital identity trust framework and introducing a digital identity regulator.

The Digital Verification Services

The Data Act formally sets up a new national digital identity framework for digital identities in the UK, called the ‘Digital Verification Services’ (DVS). The Act establishes the DVS with a broader, more structured regulatory foundation. Previously, the DVS was informally known as the ‘ United Kingdom Digital Identity & Attributes Trust Framework’ or ‘UKDIATF’.

We’re particularly supportive of the DVS which could enable UK residents to use digital identities in an ever-growing range of situations. Instead of using a passport or driving licence every time they need to prove who they are, people will be able to use a trusted and certified digital identity. This will be more convenient and give them greater control, privacy and security over their personal data.

Digital identities can already be used as proof of identity for right to work, right to rent and criminal record checks – something which is proving to be incredibly popular with businesses and individuals. The Act aims to expand the utility of digital identities to more areas in order to simplify the identity checks involved in everyday activities, such as buying age-restricted goods and accessing essential services online.

Now that the Act has become law, we’d welcome a timeline outlining when digital IDs will be formally recognised across sector-specific legislation and guidance, such as by the Financial Conduct Authority (FCA) and the Gambling Commission. This would aid Know Your Customer (KYC) checks, anti-money laundering (AML) and processes involved in buying and selling property.

We’re pleased to see planned legislative updates, such as to the Mandatory Licensing Conditions, which will allow people to use digital IDs to purchase alcohol in licensed premises by the end of 2025.

The Digital Verification Services (DVS) register

The Data Act also includes the DVS register. This publicly available register will include all certified digital verification services providers, allowing residents and businesses to understand which providers are registered and the different services they offer. All certified providers will be issued with a trust mark, making it easy to identify the trustworthy services.

This will allow people to check a provider’s certificate before choosing which one they want to create their digital ID with.

Digital identity regulator

The Office for Digital Identity and Attributes (OfDIA), planned by the previous Government, will oversee the digital identity industry. This body sits within the Department for Science, Innovation and Technology (DSIT).

Now that the Data Act has passed into law, OfDIA has gained a formal statutory remit, including enforcement powers and is responsible for ensuring that certified companies abide by the rules of the trust framework, handling consumer complaints, and consulting with industry members to further develop the framework.

What does the Data Act mean for digital identities in the UK?

As the risk of fraud continues to increase, businesses are being required to adapt their identity verification practices. As a result, it’s becoming harder for people to securely complete everyday tasks.

The Data Act aims to make things easier and safer for people in the UK who wish to prove their identity. Once digital identities have the same level of confidence and acceptance as paper documents, more businesses are likely to accept them. As a result, people may be more likely to get a digital identity as they’ll be able to use it in more places.

Digital IDs are already growing in popularity in the UK, but this Act will be a key driving force behind further adoption and unlocking their true potential.

Digital identities can offer several benefits to both businesses and customers, such as:

• Facilitating data minimisation – when businesses verify their customers’ identities with physical identity documents, they have no choice but to receive all the information on the document. Digital identities allow businesses to request certain identity details. This means they don’t need to store as much information whilst giving customers greater privacy over their personal data.
• Increased efficiency – a seamless digital identity system allows for quicker and more convenient transactions. Customers can easily access services without going through lengthy verification processes. Digital identities can also reduce the costs associated with manual identity verification checks.
• Better protection against fraud – as fraudulent documents become more sophisticated, digital verification can offer businesses a higher level of assurance when verifying customers’ identities.
• Increased inclusion – Digital identity checks can make the identity verification process easier for those people who are unable to access their physical identity documents or complete identity checks in person.

People should always have a choice when it comes to using digital identities. We’re pleased to see that the Act clearly states digital identities will not be mandatory and adoption is entirely voluntary.

What’s next for the Data Act?

Having undergone scrutiny in both the House of Lords and the House of Commons, the Data Act has now completed its parliamentary journey and received Royal Assent.

We expect OfDIA to begin exercising their powers shortly, with digital identity providers moving to the ‘Live’ version of the Digital Verification Service (DVS) not long after.”

Final thoughts

Julie Dawson, Chief Policy & Regulatory Officer at Yoti, said, “ We’re delighted to see the Data Use & Access Act (DUA) receive Royal Assent, a significant step forward for digital identities and data innovation in the UK. The establishment of the Digital Verification Service (DVS), which builds on and expands the previous Digital Identity & Attributes Trust Framework into a broader and more structured regulatory foundation, will enhance confidence in digital identities. This will enable individuals and businesses to securely access services, reduce fraud, and strengthen data privacy protections.

Digital IDs have the potential to transform how we complete everyday tasks, such as purchasing age-restricted goods and services, going through right to work or right to rent checks, opening bank accounts, and even moving house. They are already being successfully used for employment checks, and this Act opens up further opportunities to make life simpler for UK citizens by expanding the practical applications of digital IDs.

However, with countries like Australia, Singapore and the EU already progressing their digital ID systems, and the US rolling out mobile driving licences, the UK risks falling behind if a comprehensive strategy for digital identities, accredited and listed on the Digital Verification Service, is not developed promptly.

To fully realise the growth benefits and convenience for citizens, it’s crucial that the Government sets a short timeframe to publish the DVS Register to fully live statutory service and ensures that more departments begin leveraging it for a variety of services.”