SI 2025/1331 - The Data (Use and Access) Act 2025 (Consequential and Other Amendments) Regulations 2025

Status: This is the original version (as it was originally made). This item of legislation is currently only available in its original format. STATUTORY INSTRUMENTS 2025 No. 1331 DATA PROTECTION POLICE, ENGLAND AND WALES The Data (Use and Access) Act 2025 (Consequential and Other Amendments) Regulations 2025 Made - - - - 15th December 2025 Laid before Parliament 17th December 2025 Coming into force in accordance with regulation 2 The Secretary of State makes these Regulations in exercise of the powers conferred by section 27(4) of the Police and Criminal Evidence Act 1984(1), section 199(2) of the Data Protection Act 2018(2) and section 139(1) and (2)(c) of the Data (Use and Access) Act 2025(3). In accordance with section 182(2) of the Data Protection Act 2018, the Secretary of State has consulted the Commissioner(4) and such other persons as the Secretary of State considers appropriate. Citation and extent 1.—(1) These Regulations may be cited as the Data (Use and Access) Act 2025 (Consequential and Other Amendments) Regulations 2025. (2) This regulation and regulation 2 extend to England and Wales, Scotland and Northern Ireland. (3) An amendment or repeal made by regulations 3 to 18 has the same extent as the provision amended or repealed. Commencement 2.—(1) Regulation 1 and this regulation come into force on the 21st day after the day on which they are laid before Parliament. (2) Regulations 3, 4, 10, 11, 16 and 17 come into force when section 100 of the Data (Use and Access) Act 2025 comes fully into force. (1) 1984 c. 60. (2) 2018 c. 12. (3) 2025 c. 18. (4) “The Commissioner” is defined in section 3(8) of the Data Protection Act 2018 (c. 12).Document Generated: 2026-01-12 Status: This is the original version (as it was originally made). This item of legislation is currently only available in its original format. (3) Regulations 5 to 9, 12 to 15 and 18 come into force when section 86 of the Data (Use and Access) Act 2025 comes fully into force. Repeal of section 199(1) of the Data Protection Act 2018 3. In the Data Protection Act 2018, in section 199 (recordable offences), omit subsection (1). Amendment of the National Police Records (Recordable Offences) Regulations 2000 4. In the National Police Records (Recordable Offences) Regulations 2000(5), in the Schedule (specified offences), after paragraph 7 insert— “7A. section 119(6) of the Data Protection Act 2018 (offence of intentionally obstructing, or failing to assist, an inspection of personal data in accordance with international obligations); 7B. section 132(3) of the Data Protection Act 2018 (offence of knowingly or recklessly disclosing information obtained in discharging the Commissioner’s functions); 7C. section 144 of the Data Protection Act 2018 (offence of knowingly or recklessly making a false statement in response to an information notice), except as it is applied by the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016(6); 7D. section 148(2) of the Data Protection Act 2018 (offence of destroying or falsifying information and documents etc), except as it is applied by the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016; 7E. section 148C of the Data Protection Act 2018 (offence of knowingly or recklessly making a false statement in response to an interview notice)(7), except as it is applied by the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016; 7F. section 170(1) of the Data Protection Act 2018 (offence of knowingly or recklessly obtaining or disclosing, procuring or retaining personal data without the consent of the controller); 7G. section 170(4) of the Data Protection Act 2018 (offence of selling unlawfully obtained personal data); 7H. section 170(5) of the Data Protection Act 2018 (offence of offering to sell unlawfully obtained personal data); 7I. section 171(1) of the Data Protection Act 2018 (offence of knowingly or recklessly re- identifying de-identified personal data); 7J. section 171(5) of the Data Protection Act 2018 (offence of knowingly or recklessly processing personal data that has been re-identified); 7K. section 173(3) of the Data Protection Act 2018 (offence of altering etc personal data to prevent disclosure to data subject); 7L. section 184(1) of the Data Protection Act 2018 (offence of requiring the production of relevant records in connection with employment or the provision of services); 7M. section 184(2) of the Data Protection Act 2018 (offence of requiring the production of relevant records as a condition of providing goods, facilities or services); (5) S.I. 2000/1139. There are amending instruments but none is relevant. (6) S.I. 2016/696; as amended by paragraph 406 of Schedule 19 to the Data Protection Act 2018. There are other amending instruments but none is relevant. (7) Section 148C was inserted by section 100 of the Data (Use and Access) Act 2025 (c. 18). 2Document Generated: 2026-01-12 Status: This is the original version (as it was originally made). This item of legislation is currently only available in its original format. 7N. paragraph 15(1) of Schedule 15 to the Data Protection Act 2018 (offence of intentionally obstructing, or failing to assist in, the execution of a warrant), except as it is applied by the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016; 7P. paragraph 15(2) of Schedule 15 to the Data Protection Act 2018 (offence of knowingly or recklessly making a false statement in response to a requirement in the execution of a warrant), except as it is applied by the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016;”. Amendment of the Representation of the People (England and Wales) Regulations 2001 5.—(1) The Representation of the People (England and Wales) Regulations 2001(8) are amended as follows. (2) In regulation 3(1) (interpretation), for the definition of “Article 89 GDPR purposes” substitute— ““Article 84A GDPR purposes” means the purposes mentioned in Article 84A(1) of the UK GDPR (archiving in the public interest, scientific or historical research and statistics);”. (3) In regulation 61A(a) (conditions on the use, supply and inspection of absent voter records or lists), for “Article 89” substitute “Article 84A”. (4) In regulation 92(2) (interpretation), for sub-paragraph (ba) substitute— “(ba) “relevant requirement” means the requirement under Article 84B(2) of the UK GDPR, read with Article 84C of the UK GDPR, that personal data processed for Article 84A GDPR purposes must be subject to appropriate safeguards.”. (5) In regulation 97 (supply of free copy of full register to the British Library and restrictions on use), in paragraphs (5)(b) and (6), for “Article 89” substitute “Article 84A”. (6) In regulation 97A (supply of free copy of full register to the National Library of Wales and restrictions on use), in paragraphs (7)(b) and (8), for “Article 89” substitute “Article 84A”. (7) In regulation 99 (supply of free copy of full register etc to Statistics Board and restrictions on use), in paragraphs (6)(b) and (7), for “Article 89” substitute “Article 84A”. (8) In regulation 109A (supply of full register to public libraries and local authority archives service, and restrictions on use), in paragraphs (9)(b) and (10), for “Article 89” substitute “Article 84A”. (9) In regulation 119(2)(i) (conditions on the use, supply and disclosure of documents open to public inspection), for “Article 89” substitute “Article 84A”. Amendment of the Representation of the People (Scotland) Regulations 2001 6.—(1) The Representation of the People (Scotland) Regulations 2001(9) are amended as follows. (2) In regulation 3(1) (interpretation), for the definition of “Article 89 GDPR purposes” substitute— ““Article 84A GDPR purposes” means the purposes mentioned in Article 84A(1) of the UK GDPR (archiving in the public interest, scientific or historical research and statistics);”. (3) In regulation 61(3)(a) (absent voters: records and lists kept under Schedule 4), for “Article 89” substitute “Article 84A”. (8) S.I. 2001/341; as amended by S.I. 2002/1871, S.I. 2006/752, S.I. 2006/2910, paragraphs 253, 257, 258 and 260 to 264 of Schedule 19 to the Data Protection Act 2018 and S.I. 2019/419. There are other amending instruments but none is relevant. (9) S.I. 2001/497; as amended by S.I. 2006/834, S.I. 2007/925, paragraphs 266, 270 to 272 and 274 to 277 of Schedule 19 to the Data Protection Act 2018 and S.I. 2019/419. There are other amending instruments but none is relevant. 3Document Generated: 2026-01-12 Status: This is the original version (as it was originally made). This item of legislation is currently only available in its original format. (4) In regulation 61A(a) (conditions on the use, supply and inspection of absent voter records or lists), for “Article 89” substitute “Article 84A”. (5) In regulation 92(2) (interpretation), for sub-paragraph (ba) substitute— “(ba) “relevant requirement” means the requirement under Article 84B(2) of the UK GDPR, read with Article 84C of the UK GDPR, that personal data processed for Article 84A GDPR purposes must be subject to appropriate safeguards.”. (6) In regulation 96 (supply of free copy of the full register to the National Library of Scotland and the British Library and restrictions on use), in paragraphs (5)(b) and (6), for “Article 89” substitute “Article 84A”. (7) In regulation 98 (supply of free copy of full register etc to Statistics Board and restrictions on use), in paragraphs (6)(b) and (7), for “Article 89” substitute “Article 84A”. (8) In regulation 108A (supply of full register to statutory library authorities and local authority archives services, and restrictions on use), in paragraphs (9)(b) and (10), for “Article 89” substitute “Article 84A”. (9) In regulation 119(2)(i) (conditions on the use, supply and disclosure of documents open to public inspection), for “Article 89” substitute “Article 84A”. Amendment of the Representation of the People (Absent Voting at Local Government Elections) (Scotland) Regulations 2007 7. In the Representation of the People (Absent Voting at Local Government Elections) (Scotland) Regulations 2007(10), in regulation 18(1)(a) (conditions on the supply and inspection of absent voter records or lists), for “Article 89(1)” substitute “Article 84A(1)”. Amendment of the Representation of the People (Post-Local Government Elections Supply and Inspection of Documents) (Scotland) Regulations 2007 8. In the Representation of the People (Post-Local Government Elections Supply and Inspection of Documents) (Scotland) Regulations 2007(11), in regulation 5(2)(i) (conditions on the use, supply and disclosure of documents open to public inspection), for “Article 89(1)” substitute “Article 84A(1)”. Amendment of the Representation of the People (Northern Ireland) Regulations 2008 9. In the Representation of the People (Northern Ireland) Regulations 2008(12), in regulation 118(2) (conditions on the use, supply and disclosure of documents open to public inspection), for “Article 89(1)” substitute “Article 84A(1)”. Amendment of the Companies (Disclosure of Address) Regulations 2009 10. In the Companies (Disclosure of Address) Regulations 2009(13), in Schedule 2, in Part 2 (disclosure to a credit reference agency), in paragraph 6(1)(c)(iii), after “documents etc)”, insert “or section 148C of that Act (false statements made in response to interview notices)”. (10) S.S.I. 2007/170; as amended by paragraph 326 of Schedule 19 to the Data Protection Act 2018 and S.I. 2019/419. There are other amending instruments but none is relevant. (11) S.S.I. 2007/264; as amended by paragraph 327 of Schedule 19 to the Data Protection Act 2018 and S.I. 2019/419. There are other amending instruments but none is relevant. (12) S.I. 2008/1741; as amended by paragraph 331 of Schedule 19 to the Data Protection Act 2018 and S.I. 2019/419. There are other amending instruments but none is relevant. (13) S.I. 2009/214; as amended by paragraph 339 of Schedule 19 to the Data Protection Act 2018. There are other amending instruments but none is relevant. 4Document Generated: 2026-01-12 Status: This is the original version (as it was originally made). This item of legislation is currently only available in its original format. Amendment of the Overseas Companies Regulations 2009 11. In the Overseas Companies Regulations 2009(14), in Schedule 2, in Part 2 (disclosure to a credit reference agency), in paragraph 6(1)(c)(iii), after “documents etc)”, insert “or section 148C of that Act (false statements made in response to interview notices)”. Amendment of the Local Elections (Northern Ireland) Order 2010 12. In the Local Elections (Northern Ireland) Order 2010(15), in Schedule 3— (a) in paragraph 1(1) (interpretation), for the definition of “Article 89 GDPR purposes” substitute— ““Article 84A GDPR purposes” means the purposes mentioned in Article 84A(1) of the UK GDPR (archiving in the public interest, scientific or historical research and statistics);”; (b) in paragraph 5(3) (restrictions on the use, supply and disclosure of documents open to public inspection), for “Article 89” substitute “Article 84A”. Amendment of the Police and Crime Commissioner Elections Order 2012 13.—(1) The Police and Crime Commissioner Elections Order 2012(16) is amended as follows. (2) In Schedule 2— (a) in paragraph 20(8)(a) (absent voting lists: supply of copies etc), for “Article 89(1)” substitute “Article 84A(1)”; (b) in paragraph 24(3)(a) (restriction on use of absent voter records or lists or the information contained in them), for “Article 89(1)” substitute “Article 84A(1)”. (3) In Schedule 10, in paragraph 5(3)(a) (restrictions on the use of documents open to public inspection after an election), for “Article 89(1)” substitute “Article 84A(1)”. Amendment of the Neighbourhood Planning (Referendums) Regulations 2012 14. In the Neighbourhood Planning (Referendums) Regulations 2012(17), in Schedule 6— (a) in paragraph 29 (interpretation), in sub-paragraph (1)— (i)for the definition of “Article 89 GDPR purposes” substitute— ““Article 84A GDPR purposes” means the purposes mentioned in Article 84A(1) of the UK GDPR (archiving in the public interest, scientific or historical research and statistics);”; (ii)for the definition of “relevant requirement” substitute— ““relevant requirement” means the requirement under Article 84B(2) of the UK GDPR, read with Article 84C of the UK GDPR, that personal data processed for Article 84A GDPR purposes must be subject to appropriate safeguards;”; (14) S.I. 2009/1801; as amended by paragraph 340 of Schedule 19 to the Data Protection 2018. There are other amending instruments but none is relevant. (15) S.I. 2010/2977; as amended by paragraph 364 of Schedule 19 to the Data Protection Act 2018 and S.I. 2019/419. There are other amending instruments but none is relevant. (16) S.I. 2012/1917; as amended by paragraphs 368 and 369 of Schedule 19 to the Data Protection Act 2018 and S.I. 2019/419. There are other amending instruments but none is relevant. (17) S.I. 2012/2031; as amended by S.I. 2013/798, paragraphs 372 and 374 to 377 of Schedule 19 to the Data Protection Act 2018 and S.I. 2019/419. There are other amending instruments but none is relevant. 5Document Generated: 2026-01-12 Status: This is the original version (as it was originally made). This item of legislation is currently only available in its original format. (b) in paragraph 33 (supply of copy of business voting register to the British Library and restrictions on use), in sub-paragraphs (6)(b) and (7), for “Article 89” substitute “Article 84A”; (c) in paragraph 34 (supply of copy of business voting register to the Office for National Statistics and restrictions on use), in sub-paragraphs (6)(b) and (7), for “Article 89” substitute “Article 84A”; (d) in paragraph 39 (supply of copy of business voting register to public libraries and local authority archives services, and restrictions on use), in sub-paragraphs (8)(b) and (9), for “Article 89” substitute “Article 84A”; (e) in paragraph 45(2)(a) (conditions on the use, supply and disclosure of documents open to public inspection), for “Article 89” substitute “Article 84A”. Amendment of the Scottish Parliament (Elections etc.) Order 2015 15.—(1) The Scottish Parliament (Elections etc.) Order 2015(18) is amended as follows. (2) In Schedule 3— (a) in paragraph 16(4)(a) (absent voting lists: supply of copies, etc.), for “Article 89(1)” substitute “Article 84A(1)”; (b) in paragraph 20(3)(a) (conditions on the use, supply and inspection of absent voter lists), for “Article 89(1)” substitute “Article 84A(1)”. (3) In Schedule 8, in paragraph 5(3)(a) (restriction on use of documents open to public inspection, or of information contained in them), for “Article 89(1)” substitute “Article 84A(1)”. Amendment of the Companies (Disclosure of Date of Birth Information) Regulations 2015 16. In the Companies (Disclosure of Date of Birth Information) Regulations 2015(19), in Schedule 2, in Part 2 (disclosure to a credit reference agency), in paragraph 6(1)(c)(iii), after “documents etc)”, insert “or section 148C of that Act (false statements made in response to interview notices)”. Amendment of the Register of People with Significant Control Regulations 2016 17. In the Register of People with Significant Control Regulations 2016(20), in Schedule 4, in Part 2 (disclosure to a credit reference agency), in paragraph 6(c)— (a) omit the “or” after paragraph (iv); (b) after paragraph (v), insert— “or (vi) section 148C of that Act (false statements made in response to interview notices);”. (18) S.S.I. 2015/425; as amended by paragraphs 396 and 397 of Schedule 19 to the Data Protection Act 2018 and S.I. 2019/419. There are other amending instruments but none is relevant. (19) S.I. 2015/1694; as amended by paragraph 384 of Schedule 19 to the Data Protection Act 2018. There are other amending instruments but none is relevant. (20) S.I. 2016/339; as amended by paragraph 400 of Schedule 19 to the Data Protection Act 2018. There are other amending instruments but none is relevant. 6Document Generated: 2026-01-12 Status: This is the original version (as it was originally made). This item of legislation is currently only available in its original format. Amendment of the Senedd Cymru (Representation of the People) Order 2025 18. In the Senedd Cymru (Representation of the People) Order 2025(21), in Schedule 1, in paragraph 19(1)(a) (conditions on the use, supply and inspection of absent voter records or lists)— (a) in the English text version for “article 89(1)” substitute “article 84A(1)”; (b) in the Welsh text version for “erthygl 89(1)” substitute “erthygl 84A(1)”. Ian Murray Minister of State Department for Science, Innovation and 15th December 2025 Technology (21) S.I. 2025/864 (W.150). 7Document Generated: 2026-01-12 Status: This is the original version (as it was originally made). This item of legislation is currently only available in its original format. EXPLANATORY NOTE (This note is not part of the Regulations) These Regulations make amendments which are consequential on provisions in the Data (Use and Access) Act 2025 (c. 18) (“the 2025 Act”). They also make related changes in relation to recordable offences. Regulation 4 makes the new offence under section 148C of the Data Protection Act 2018 (c. 12) (“the 2018 Act”) (giving false information to the Information Commissioner in response to an interview notice) recordable by inserting it into the Schedule to the National Police Records (Recordable Offences) Regulations 2000 (S.I. 2000/1139). Regulation 4 also inserts other offences under the 2018 Act into that Schedule. These further insertions do not change the current position as the offences are already treated as recordable by virtue of section 199(1) of the 2018 Act, which is repealed by regulation 3. Regulations 5 to 9, 12 to 15 and 18 update cross references in subordinate legislation to provisions of the UK GDPR and the 2018 Act, as amended by the 2025 Act, concerning the processing of personal data for scientific or historical research, archiving in the public interest or statistical purposes and required safeguards. Regulations 10, 11, 16 and 17 insert references to the new offence under section 148C of the 2018 Act into certain companies legislation. A full impact assessment has not been produced for this instrument as no, or no significant, impact on the private, voluntary or public sector is foreseen. 8