Data (Use and Access) Act 2025

Clause 2, page 3, line 28, at end insert— “(1A) The Secretary of State may by regulations make provision requiring a data holder to communicate (to the extent that they have the data required to do this) in a specified manner with all or a subset of the customers for whom they hold data.”

Clause 4, page 6, line 12, at end insert “(including the Secretary of State or the Treasury; publicly-owned bodies and local and regional authorities).”

Clause 4, page 6, line 36, at end insert— “(d) make provision requiring business data to be published or provided in a machine readable format.”

Clause 4, page 6, line 10, after first “business data” insert “in a machine readable format”

Clause 2, page 3, line 23, leave out “or the Treasury”

Clause 3, page 5, line 28, at end insert— (f) provision requiring that third party recipients of customer data publish regular statements on their cyber resilience against specified standards and outcomes.”

Clause 2, page 3, line 23, leave out “Secretary of State or the”

Clause 6, page 10, line 10, at end insert— “(d) to review the guidance annually, and

Clause 6, page 10, line 9, after “guidance” insert “on their website”

Clause 1, page 2, leave out lines 34 to 37

Clause 8, page 13, line 34, at end insert— “(d) to review the guidance annually, and

Clause 1, page 2, leave out lines 40 to 43

Clause 12, page 17, line 39, at end insert “, the rate of which will be capped at 5 per cent”

Clause 2, page 3, line 28, at end insert— “(1A) In a case where the Secretary of State and the Treasury have made regulations under this Act, any regulations made by the Secretary of State may include revocation of any regulations made by the Treasury, but regulations made by the Treasury may not revoke regulations made by the Secretary of State.”

Clause 11, page 17, line 3, at end insert— “(7A) The Secretary of State must provide guidance on who may be charged a fee, which must be reviewed annually.”

Clause 8, page 13, line 33, after “guidance” insert “on its website”

Clause 11, page 17, line 7, at end insert— “(9) Regulations under subsection (1) must provide a mechanism by which an individual may appeal the charging of a fee.”

Clause 12, page 17, line 40, at end insert— “(c) the process of appealing against amounts payable by way of a levy.”

After Clause 132, insert the following new Clause— “Digitally created sexually explicit photographs or films

After Clause 132, insert the following new Clause— “Digitally created sexually explicit audio

After Clause 50, insert the following new Clause— “Digital identity documents and digital identity theft review

Clause 56, page 52, line 13, leave out “undertaker’s” and insert “contractor’s”

Clause 90, page 113, line 20, after “children” insert “merit specific protection with regard to their personal data because they”

Clause 3, page 6, line 7, at end insert— “(12) In this Act, a “data community” means an entity established to activate data subjects’ data rights under Chapters III and VIII of the UK GDPR on their behalf.”

Clause 90, page 113, line 15, at end insert “in accordance only with the Commissioner’s duties under section 108 of the Deregulation Act 2015 (exercise of regulatory functions: economic growth).”

Clause 2, page 4, line 1, after “to” insert “the customer's data rights or”

Clause 90, page 113, leave out lines 20 to 22 and insert— “(e) the fact that children are entitled to a higher standard of protection than adults with regard to their personal data;

After Clause 92, insert the following new Clause— “Code of practice on Children's Data and Education

Clause 3, page 4, line 24, at end insert— “(2A) The regulations must include data communities in the list of specified people.”

After Clause 92, insert the following new Clause— “Code of practice on data communities

After Clause 92, insert the following new Clause— “Code of practice on children and AI

After Clause 92, insert the following new Clause— “Register and oversight of data communities

Clause 101, page 129, line 38, at end insert— “(5A) The report must—

Clause 28, page 31, line 22, at end insert— “(11) The Secretary of State must lay the DVS trust framework before Parliament.”

Clause 28, page 30, line 28, at end insert— “(2A) In preparing the DVS trust framework the Secretary of State must assess whether the public authorities listed in subsection (2B) reliably ascertain the personal data attributes that they collect, record and share.

Clause 45, page 42, line 23, at end insert— “(5A) A public authority must not disclose information about an individual under this section unless the information—

Clause 1, page 3, line 11, at end insert— “(5A) In subsection (2), references to information includes inferred data.”

Leave out Clause 13

After Clause 104, insert the following new Clause— “Review of court jurisdiction

Clause 94, page 119, line 1, at end insert— “(1) In the 2018 Act, in section 139, after subsection (2) insert—

After Clause 80, insert the following new Clause— “Data protection by design: children’s higher protection matters

[<i>Withdrawn</i>] After Clause 139, insert the following new Clause—

Title, line 18, after “services;” insert “to make provision about the creation of purported intimate images;”

Clause 142, page 174, line 22, at end insert— “(c) section (<i>Creating purported intimate image of adult</i>) (creating purported intimate image of adult) extends to England and Wales only.”

After Clause 139, insert the following new Clause— “Creating purported intimate image of adult

In the title of inserted section 66F, after “Creating” insert “or soliciting the creation of”

After “creation” insert “and solicitation”

In inserted section 66E(6), leave out “a fine” and insert “imprisonment for a term not exceeding the maximum term for a summary offence or a fine (or both)”

In inserted section 66E, leave out subsection (5)

In inserted section 66E, after subsection (1) insert— “(1A) A person (A) commits an offence if—

In the title of inserted section 66E, after “Creating” insert “or soliciting the creation of”

Schedule 15, page 255, line 35, at end insert— “(5) This section does not authorise the processing of information if the processing would contravene the data protection legislation (but in determining whether it would do so, take into account the power conferred by this section).

Clause 67, page 75, line 26, leave out “and that is conducted in the public interest”

Page 173, line 13, leave out Clause 140

Clause 117, page 149, line 11, at end insert— “(5A) In Schedule 13, paragraph 1(1), at end insert—

Clause 141, page 173, line 35, leave out from beginning to end of line 8 on page 174

Clause 141, page 174, line 26, at end insert— “(7A) It is a defence for a person charged with an offence under this section to prove that the person had a reasonable excuse for creating the purported intimate image.”

Page 170, line 2, leave out Clause 135

Page 171, line 15, leave out Clause 137

Page 170, line 23, leave out Clause 136

Page 171, line 37, leave out Clause 138

Page 173, line 1, leave out Clause 139

Clause 141, page 173, line 27, leave out “or soliciting the creation of”

Clause 95, page 120, line 31, leave out subsection (1)

Clause 141, page 174, line 29, at end insert— “66EA Requesting the creation of purported intimate image of adult

Clause 80, page 95, line 19, at end insert— “(3) To qualify as meaningful human involvement, a review must be performed by a person with the necessary competence, training, authority to alter the decision and analytical understanding of the data.”

Clause 127, page 161, line 36, at end insert— “(6A) An authority which retains biometric data under this Part must—

Clause 70, leave out from line 24 on page 78 to line 32 on page 79

Clause 70, page 78, line 17, after “interest” insert “, excluding personal health data”

Schedule 14, page 242, line 33, at end insert— “(1A) The appointment of the Chair of the Information Commission must be subject to approval by a resolution of each House of Parliament.”

Clause 70, page 78, leave out lines 15 to 19

To move the following Clause— “Technical solutions

To move the following Clause— “Transparency of crawler identity, purpose and segmentation

To move the following Clause— “Enforcement

To move the following Clause— “Data use in Public Service Delivery Review

To move the following Clause— “Age of consent for social media data processing

To move the following Clause— “Transparency of copyrighted works scraped

To move the following Clause— “Departmental Board Appointments

To move the following Clause— “Data Vision and Strategy

To move the following Clause— “Right to use non-digital verification services

To move the following Clause— “Compliance with UK copyright law by operators of web crawlers and general-purpose AI models

Clause 56, page 57, leave out lines 35 and 36 and insert “obtain the consent of the Welsh Ministers in relation to any provision which would be within the legislative competence of Senedd Cymru if contained in an Act of the Senedd (ignoring any requirement for the consent of a Minister of the Crown imposed under Schedule 7B to the Government of Wales Act 2006).”

Clause 59, page 69, leave out lines 35 and 36

Clause 57, page 61, line 17, leave out subsections (8) and (9)

Clause 57, page 60, line 2, leave out “consult the Welsh Ministers” and insert “obtain the consent of the Welsh Ministers in relation to any provision that relates to apparatus in streets in Wales”

Clause 57, page 60, leave out line 28

Clause 58, page 67, leave out lines 25 to 27 and insert— “(A1) Before making regulations under this Order the Secretary of State must obtain the consent of the Department for Infrastructure.”

Clause 57, page 60, line 25, at end insert— “(4A) Before making regulations under this section the Secretary of State must obtain the consent of the Welsh Ministers in relation to any provision that relates to apparatus in streets in Wales.”

To move the following Clause— “Access to a deceased child’s social media data

To move the following Clause— “Access to a deceased child’s social media data

To move the following Clause— “Raising the minimum age at which users can consent to processing of personal data