The Data (Use and Access) Act 2025 (Commencement No. 4) Regulations 2025 bring most of Part 2 on digital verification services into force on 1 December 2025. The instrument, UK SI 2025/1213 (C. 62), was made on 19 November 2025 and expressly excludes sections 45–48 at this stage.
Part 2 sets out the legal structure for digital verification services: a trust framework and any supplementary codes, a public register of providers, an information gateway, and a trust mark. The Act defines digital verification services as verification carried out online at an individual’s request.
The Secretary of State must establish and maintain a publicly available DVS register. Registration is available where a provider holds a certificate from an accredited conformity assessment body, applies in respect of the certified services, meets any application requirements and pays any prescribed fee.
For these purposes, an accredited conformity assessment body is one accredited by the UK national accreditation body under Regulation (EC) No 765/2008. The register records the specific services for which a provider is registered and registration may be refused in defined circumstances.
Application mechanics and fees sit outside the commencement itself. Section 38 enables the Secretary of State to determine the form, content and submission method for applications (and to publish that determination), while section 39 provides for regulations setting application and ongoing registration fees.
Notably, the information‑sharing gateway is not yet in force. Sections 45–48 would allow public authorities, including HMRC and the Welsh Revenue Authority, to disclose information to registered providers for verification purposes under strict conditions and offences, but these provisions are excluded from this commencement.
The timetable is consistent with DSIT’s published staged approach to commencement of the Act. Earlier regulations began on 20 August and early September 2025; this fourth instrument turns on the core DVS chapter while leaving the information gateway to a later phase.
In practical terms, 1 December 2025 activates the enabling provisions for the DVS register and the trust‑framework model. Providers will need certification aligned to the framework and will rely on published application requirements; however, they cannot use the statutory public‑authority data gateway until sections 45–48 commence.
No separate impact assessment accompanies this commencement instrument. DSIT has published an enactment impact assessment for the Act as a whole, released on 31 October 2025 and available via GOV.UK.