UK digital verification rules start on 1 December 2025
From 1 December 2025, most of Part 2 of the Data (Use and Access) Act 2025 takes effect. The Government has signed the fourth commencement regulations to switch this on, with one big caveat: sections 45 to 48 are held back for now. The instrument, published on legislation.gov.uk, confirms the start date and the carve‑out.
So what is Part 2 in plain English? It creates the rulebook for digital verification services - the companies that confirm facts about you online (for example age, address or a licence) and then tell a third party that the fact has been checked. The Act lists five pillars: a trust framework, supplementary codes, a public register of providers, an information‑sharing gateway, and a trust mark you can recognise.
Here’s what actually begins on 1 December. The Secretary of State can publish the Digital Verification Services (DVS) trust framework and any supplementary codes, which set the standards providers must follow. A new public DVS register must also be established. To be listed, a provider needs a certificate from an accredited conformity assessment body and must apply in the form and with any fees set by the Secretary of State. The register has to be publicly available.
You’ll also start to see an official trust mark. Only providers that are on the DVS register will be allowed to use it when offering digital verification services. This is designed to give you a quick visual cue that a service has met the registration tests. Misuse of the mark can be stopped in court.
What is not starting in December matters too. The new legal gateway that would let public authorities share information with registered providers - and the special safeguards for UK tax authorities - are all paused. In law these are section 45 (the general gateway) and sections 46–48 (rules and offences covering HMRC, the Welsh Revenue Authority and Revenue Scotland). They are specifically excluded from the 1 December commencement.
What this means for you as a user: digital checks should become more consistent over time because providers will have to follow the trust framework and appear on a public register. When you’re asked to verify something, you should be able to confirm whether the provider is registered and, in due course, look out for the trust mark. The Act’s definition is clear that a DVS check involves verifying a fact about you from a source other than you, at your request.
If you work in a school, college, youth service or a students’ union, this is practical groundwork rather than a switch‑on of government data feeds. Age checks for online platforms or proof‑of‑status for student discounts may use registered providers, but the public‑authority sharing gateway is not yet live. The headline for now: stronger rules and visibility for providers; no new automatic access to government‑held data.
If you build or buy these services, note the compliance pathway. Registration depends on an independent certificate that your services meet the trust framework, and the Secretary of State can refuse or remove registration where standards aren’t met or on national security grounds. The law also provides for removal of particular services or supplementary notes from the register, and for fees and information requests from DSIT.
Oversight is baked in. The Secretary of State must review the trust framework and any supplementary codes at least every 12 months and publish reports on how Part 2 is working, not more than 12 months apart. There must also be a code of practice for disclosures made under the (future) section 45 gateway, and public authorities will have to have regard to it when that gateway is commenced.
What to watch next: DSIT’s staged plan always envisaged bringing most of Part 2 into force ahead of other parts of the Act, with the information‑sharing gateway to follow when ready. Keep an eye on the publication of the DVS trust framework and the opening of the public register, both signposted in law; the sections enabling public‑authority data sharing will be a separate step.