Summary

• A draft statutory code under the Data (Use and Access) Act 2025 sets out how public authorities should use the existing information sharing power for registered digital verification services.
• Authorities must check that the specific service is certified and registered, verify the individual's request, and meet data protection and minimisation requirements.
• Providers may be charged proportionate, cost-neutral fees. The code requires parliamentary approval and does not establish a compulsory digital identity scheme or unrestricted access to public records.

Public authorities could share selected information with registered digital verification services under a new statutory code setting out the safeguards required before an individual’s identity or eligibility details are disclosed.

The government published the draft code on 21 October under the Data (Use and Access) Act 2025, describing how authorities should assess requests from providers that help people prove facts about themselves to banks, employers and other organisations.

The proposed guidance covers provider registration, lawful processing, data minimisation, security arrangements and the circumstances in which an authority can recover the cost of sharing information.

The Office for Digital Identities and Attributes maintains the framework for registered verification services, while public authorities retain responsibility for determining whether individual disclosures meet the conditions established by legislation.

Public records can support private verification

Digital verification services allow individuals to demonstrate information about their identity or eligibility without necessarily presenting a complete identity document whenever they need to complete a transaction.

A person opening a bank account, for example, may need to prove their identity, while a transaction involving an age restriction may require confirmation that the customer meets a minimum age.

In some circumstances, the organisation providing the service needs confirmation of a particular fact rather than access to every detail used to establish it.

Public authorities already hold records that could support those checks, although the information may be subject to legal restrictions and stored in systems not designed for external verification requests.

Section 45 of the Data Act provides a legal power allowing an authority to disclose information to a registered digital verification service when the disclosure supports a service requested by the individual concerned.

The power does not permit general commercial access to public databases or allow a provider to request personal information without a relevant individual verification purpose.

Authorities must also respect other legal restrictions on disclosure and the requirements of data protection legislation.

The draft code is issued under section 49 of the Act and provides guidance on how the existing information sharing power should operate.

It has been laid before Parliament and requires approval by both Houses before acquiring its final statutory status.

Publication of the draft therefore establishes the proposed guidance rather than confirming that the completed code has already been approved.

Registration applies to the specific service

A provider seeking information under section 45 must offer a digital verification service that is certified against the relevant requirements and currently recorded on the statutory register.

Certification and registration are separate conditions. A provider holding a certificate but not appearing on the register does not qualify for access through this mechanism.

The draft code also recognises that one organisation may operate several digital verification products.

Some of those services may be registered while others are not, meaning registration of the business itself cannot be treated as permission for every application it operates.

Public authorities must check that the particular service requesting information is registered before establishing an information sharing arrangement.

They must repeat the check immediately before the information is released.

These requirements create practical obligations for authorities developing automated connections with verification providers.

Systems must identify the eligible service, confirm its current status and prevent requests being processed where the relevant registration has expired or been withdrawn.

The code allows authorities to consider machine-readable information from the register when designing these checks.

However, automation must reflect the current registration conditions rather than relying indefinitely on information collected when a provider first connected to the system.

Individual requests determine what may be shared

The information sharing power applies where the individual has requested the verification service and the disclosure is necessary to support that request.

Authorities must be satisfied that the provider is authorised to make the request and that the information relates to the intended verification.

Where personal data is involved, the authority must establish an appropriate lawful basis under data protection legislation, including the UK GDPR.

The draft guidance also emphasises data minimisation, requiring organisations to avoid sharing more personal information than is needed for the specified purpose.

For example, a provider checking whether a person meets an age requirement may be able to receive a simple confirmation that the threshold has been satisfied.

Such a response could avoid disclosing the person’s full date of birth or an entire identity record.

However, the appropriate information depends on the purpose of the verification, the role of the provider and the quality of the source records.

Authorities must consider whether their information is accurate and suitable for answering the relevant question before releasing it.

An automated response can be transmitted securely while still being wrong if the underlying record is incomplete or out of date.

Reliable verification therefore requires attention to the information being shared as well as the controls surrounding access to it.

The code also addresses arrangements involving providers based overseas, where disclosures may engage the UK GDPR requirements governing international transfers.

Authorities should not refuse requests arbitrarily

Although section 45 establishes a power rather than requiring disclosure in every circumstance, the draft code encourages public authorities to share suitable information where the legal conditions are met.

It states that requests should not be refused without reasonable justification and recommends appropriate consideration of the legal and operational grounds for any refusal.

Authorities may need to assess confidentiality, information quality, technical limitations and other statutory restrictions before deciding whether the requested information can be supplied.

The code also recommends that an authority explain a refusal and obtain suitable legal advice where appropriate.

These provisions are intended to avoid a system in which access depends arbitrarily on which registered provider makes a request.

Where an authority establishes a technical interface for sharing information, the guidance expects comparable access for other eligible registered services unless there are legitimate commercial or legal reasons for different treatment.

That principle could influence competition between digital verification providers, particularly where access to authoritative public records makes one service more useful than another.

However, equal access does not remove the need for every provider to meet the applicable certification, registration and information security requirements.

Cost recovery may shape commercial services

The legislation permits authorities to charge registered verification providers for supplying information through the statutory gateway.

The draft code says those charges should be proportionate, fair and cost neutral rather than designed to generate a profit.

Authorities may consider charging for individual verification checks, requiring an upfront payment or combining the two approaches.

Recoverable costs can include developing and maintaining technical systems, administration, security, governance and work required to support information sharing.

For providers, the resulting charges may influence the economics of offering identity or eligibility checks to commercial customers.

A service processing many low-value transactions may be sensitive to per-check costs, while another provider may prefer more predictable arrangements for maintaining technical connections.

The code does not establish a single national tariff or guarantee that every authority will use the same charging structure.

Authorities are expected to document the basis of their charges and avoid unjustified differences between providers.

These arrangements would need to be reflected in the commercial and technical agreements governing access to information.

Sharing agreements define operating responsibilities

The draft code recommends that authorities establish data sharing or contractual agreements before information is exchanged.

Such arrangements should describe the purpose of disclosure, the information involved, security measures and restrictions on subsequent use.

They should also address retention, deletion, incident handling and the arrangements applying if a provider loses its registered status.

Onward sharing requires particular attention because a verification provider will often pass information or a verification result to another organisation.

That recipient may be a bank, employer or other service provider that needs to establish whether an individual meets a defined requirement.

The parties must determine which information the recipient actually requires and how the provider can fulfil the verification without disclosing unnecessary personal details.

These controls also depend on reliable identity checking, because public authorities must be confident that a provider’s request relates to the individual seeking the service.

Technical security alone cannot establish that authorisation if the process used to identify or authenticate the person is inadequate.

The draft therefore connects certification, lawful processing and operational agreements rather than treating verification as a simple exchange between two databases.

The gateway is separate from One Login

The information sharing framework should not be confused with GOV.UK One Login, which provides access and identity verification functions for participating government services.

Section 45 concerns a separate mechanism through which registered verification providers may request selected information from public authorities for services chosen by individuals.

Techopia previously examined the expansion of GOV.UK One Login, which remains a distinct public service programme.

The draft statutory code does not create a compulsory national identity card or require people to use one particular private digital verification provider.

It also does not establish that every authority has already connected its records to a commercial verification network.

Implementation will depend on the legal and technical readiness of participating authorities, including the quality of their records and their ability to maintain secure, appropriately governed interfaces.

The proposed framework gives registered providers a possible route to authoritative information while preserving conditions concerning individual requests, lawful disclosure and the protection of personal data.

The next legislative milestone is approval of the statutory code by both Houses of Parliament. Until then, the published document remains draft guidance, while the underlying statutory information sharing power and existing data protection obligations must be considered separately.