UK to commence Data Act Part 2 on 1 December 2025

Let’s make this simple: the UK has signed the Commencement No. 4 Regulations for the Data (Use and Access) Act 2025. That switch brings most of Part 2-about digital verification services-into force on 1 December 2025. The statutory instrument was made on 19 November 2025 and recorded on legislation.gov.uk.

A commencement regulation is not a new law; it is the official on‑switch for parts of an Act that were waiting to start. Parliament passed the Act earlier this year. Each commencement notice turns on more sections in stages, which is why this one is labelled ‘No. 4’.

Part 2 sets the rules for digital verification services in the UK. Think of services that prove something about you online-age, identity or a credential-without revealing more than needed. Under the Act, providers may apply to be registered on a government register and operate against common standards.

There is one big exception to the 1 December start. Sections 45 to 48 are not beginning yet. Those sections cover public authorities sharing information with registered digital verification service providers, and they will need a future commencement before they take effect.

Who does this touch first? Providers that build digital verification tools, and organisations that rely on them. You may see updated terms, clearer privacy information and references to registration under the Act. For users, the goal is more consistent checks and clearer accountability.

In education settings, identity and age checks crop up during enrolment, exams, safeguarding and placements. You might start seeing providers describe themselves as ‘registered under the Data (Use and Access) Act 2025’. That label signals the service is working within the new legal framework.

Dates and names matter. The instrument was made on 19 November 2025 by Ian Murray, Minister of State at the Department for Science, Innovation and Technology, using section 142(1) powers. The coming into force date for most of Part 2 is 1 December 2025; sections 45 to 48 wait for a later switch‑on.

How do you check this for yourself? On legislation.gov.uk, search for ‘Data (Use and Access) Act 2025 (Commencement No. 4) Regulations 2025’ and read regulation 2 for the date and exceptions. For background, the government’s impact assessment was published with the Bill on GOV.UK rather than with this instrument.

What it means right now: the legal framework for registering and running digital verification services is live from 1 December. The public‑sector data‑sharing provisions are not. Expect another commencement regulation when ministers are ready to start sections 45 to 48.

If you work on policy, IT or data protection, take a light‑touch readiness check. Map the verification services you use, ask providers about their registration plans, and prepare to update contracts and data protection impact assessments. If you teach or study, follow your institution’s guidance before adopting new tools.