Statutory guidance

Explanatory memorandum to the code of practice for public authorities sharing information with digital verification services

Published 21 October 2026

1. Introduction 

1.1. This Explanatory Memorandum has been prepared by the Department for Digital, Culture, Media and Sport and is laid before Parliament by Command of His Majesty.  

1.2. This memorandum contains information for the Secondary Legislation Scrutiny Committee and the Joint Committee on Statutory Instruments.

2. Declaration  

2.2. Stephanie Peacock MP, Parliamentary Under-Secretary of State for the Department for Digital, Culture, Media and Sport confirms that this Explanatory Memorandum meets the required standard. 

2.3. John Peart, Deputy Director for the Office for Digital Identities and Attributes, at the Department for Digital, Culture, Media and Sport confirms that this Explanatory Memorandum meets the required standard. 

3. Contact 

3.1. John Peart at the Office for Digital Identities and Attributes, part of the Department for Digital, Culture, Media and Sport can be contacted by email at the following address with any queries regarding the instrument: parliamentaryteam@dcms.gov.uk. Alternatively, Mr Peart can be contacted by telephone: 0207 2153 902. 

Part One: Explanation, and context, of the Instrument 

4. Overview of the Instrument 

What does the legislation do?  

4.1. This code of practice (the ‘Code’) contains practical guidance for public authorities when sharing information under the power in section 45 of the Data (Use and Access) Act 2025 (the ‘Act’) and is intended to help ensure appropriate use of the power.  

4.2. Section 45 allows public authorities to share information with digital verification services (DVS) providers that are certified against government standards for DVS (referred to as ‘the DVS trust framework’) and registered in the government’s DVS register. A DVS is a service that enables people to digitally prove who they are, information about themselves or their eligibility to do something. They are typically delivered via a mobile application or web browser. The statutory DVS register is established under section 32 of the Act and is available at: https://www.digital-identity-services-register.service.gov.uk. 

4.3. Information about an individual can only be shared where necessary for the purposes of providing DVS to an individual at their request.  

Where does the Code extend to, and apply? 

4.4. The extent of this instrument (that is, the jurisdiction(s) which the instrument forms part of the law of) is England and Wales, Scotland and Northern Ireland. 

4.5. The territorial application of this instrument (that is, where the instrument produces a practical effect) is England and Wales, Scotland and Northern Ireland. 

5. Policy Context  

What is being done and why? 

5.1. The publication of the Code is a statutory requirement under section 49 of the Act. The Code has been prepared and published to facilitate the appropriate use of the information sharing power in section 45 of the Act. The Code sets out guidance for public authorities to help ensure the requirements of section 45 are met when information is shared.  

5.2. It includes detailed guidance for public authorities, including how they can check the DVS register before information is shared, what public authorities should consider before information is shared and what might be included in contractual arrangements between public authorities and registered DVS. The Code is split into 4 main sections: 

• Overview: This explains what the Code is, who it is for and who was consulted. 

• Explanation of legal powers: This sets out the requirements of the information sharing power and the conditions that must be met before information can be shared. 

• Relevant legislation: This section highlights other key legislation that must be complied with when data is shared, such as UK General Data Protection Regulation (UK GDPR). It does not include an exhaustive list. 

• Process for using the information sharing power: The final section includes more practical information on the steps public authorities should take to prepare for information sharing under section 45 of the Act, such as preparing a data sharing agreement with the registered DVS provider, and more detail on how public authorities should consider data protection principles such as data accuracy and data minimisation. There are references to Information Commission (ICO)’s guidance on relevant areas.  

5.3. The Code helps to ensure that public authorities understand their obligations and are confident to implement use of the information sharing power. The existence of a Code aims to provide further confidence to individuals that information shared under this power will be shared consistently and securely with registered DVS, in line with existing data protection legislation. 

What was the previous policy, how is this different? 

5.4. People currently often rely on physical documents – such as passports and driving licences – to prove who they are or whether they are eligible for certain regulated products and services. This means that many verification processes across the economy rely on physical documents, which can be costly, inefficient and sometimes vulnerable to fraud. In an increasingly digital world, this creates unnecessary friction by often requiring people to present documents in-person or to send them via post. Prior to the Act, some identity verification was beginning to take place digitally, but a lack of common standards prevented more widespread adoption.  

5.5. Part 2 of the Act aims to create a trusted ecosystem of DVS that provide convenient and reliable options for people to prove things about themselves digitally if they choose to. The independent certification scheme against government rules and the government’s DVS register helps to create a trusted market where individuals and businesses can easily identify which DVS they can trust. This aims to drive adoption and generate economic growth through enabling smoother, cheaper and secure online transactions, saving time and money for businesses and individuals.    

5.6. The Code relates to a new power to share information held by public authorities created under Part 2 of the Act. The information sharing power will provide public authorities with the power to share authoritative data with registered DVS, where certain conditions are met, to allow them to provide these services more effectively and reduce the need for people to provide physical documents. The Code will help ensure appropriate and consistent use of the information sharing power by public authorities. 

6. Legislative and Legal Context 

How has the law changed?  

6.1. Section 49(1) of the Act imposes a duty on the Secretary of State to prepare and publish a code of practice. While the Code is not a statement of law, a public authority must have regard to it, under section 49(3), in disclosing information under section 45 of the Act. Section 45 allows public authorities to share information with registered DVS which is necessary for the purposes of providing digital verification services at the individual’s request.  

6.2. Section 49(2) requires the Code to be consistent with the Data Sharing Code of Practice that the Information Commission must produce under section 121(1) of the Data Protection Act 2018. 

Why was this approach taken to change the law?  

6.3. This is the only possible approach to make the necessary changes.  

7. Consultation  

Summary of consultation outcome and methodology 

7.1. Section 49(5) of the Act requires that the Secretary of State consults with the devolved governments, the Information Commission and any other persons the Secretary of State considers appropriate in preparing the Code. To satisfy this requirement, the Department has consulted with the Information Commission, Welsh Ministers, Scottish Ministers and the Department of Finance in Northern Ireland. Several versions of the draft Code were shared with officials of the devolved governments for feedback.  

7.2. The Department also consulted with a number of external organisations including consumer protection groups, industry bodies, and civil society organisations that engaged with the government during the passage of the Act. A draft version of the Code was shared with these organisations and meetings were conducted in March 2026. 

7.3. Finally, the Department also engaged with officials in several government departments and public bodies, including Cabinet Office, Home Office, Department for Business, Innovation, Science and Trade, HM Revenue and Customs, Department for Work and Pensions, Driver and Vehicle Licensing Agency, HM Passport Office and the General Register Office to gather feedback on the Code before finalising the draft.  

8. Applicable Guidance 

8.1. DCMS expect that further non-statutory guidance and information on the information sharing power will be available for public authorities and registered DVS on GOV.UK later this year. This will include more practical information such as diagrams and templates, which would not be suitable for statutory guidance. These will be developed in response to the needs of public authorities and registered DVS and in consultation with them so will not be ready at the same time as the Code. 

8.2. In addition, the ICO provides extensive guidance on data sharing that is relevant for public authorities sharing information under the information gateway. Relevant ICO guidance is referenced throughout the Code. 

Part Two: Impact and the Better Regulation Framework  

9. Impact Assessment 

9.1. An impact assessment is not required for this instrument because it does not place any new burdens on public authorities. A full impact assessment prepared for the Act during its parliamentary passage covers the benefits and burdens it generates and is available on GOV.UK.

9.2. The impact assessment estimated that the use of secure digital identities underpinned by Part 2 of the Act offers large potential economic benefits, with estimated net benefits of between £1.3 billion and £6.2 billion to the UK economy over a 10-year period. 

Impact on businesses, charities and voluntary bodies 

9.4. There is no, or no significant, new impact on business, charities or voluntary bodies because the Code does not create any new requirements. 

9.5. There is no, or no significant, new impact on small or micro businesses for the same reason highlighted above.  

9.6. There is no, or no significant, new impact on the public sector. For public authorities using the information gateway, it is assumed that they will face familiarisation costs, costs to digitise any documents in paper-only form (e.g. birth certificates before a certain year), costs to allow private sector access to their databases and costs to set up and run the governance function. Apart from digitisation costs, these costs, including infrastructure, change costs, and estimated annual ongoing costs, were included in the net benefits calculations in the impact assessment for the Act. 

10. Monitoring and review 

What is the approach to monitoring and reviewing this Code?  

10.1. The Code may be revised from time to time and republished, under section 49(4) of the Act. Any revision to the Code must involve consultation with the devolved governments, the ICO and other persons the Secretary of State considers appropriate.  

10.2. The instrument does not include a statutory review clause. 

10.3. Section 53 of the Act requires the Secretary of State to publish an annual report on the operation of Part 2 (which includes the information sharing power). The first annual report was published by the Secretary of State in July 2026. 

10.4. A post implementation review of the Act will be produced within 5 years of the implementation. This will include carrying out proportionate and appropriate research including: 

• process evaluations to check how things are happening and how changes are being made to improve implementation of future reforms. 

• impact evaluations to assess the scale of effects caused by the planned changes, compared to initial ambition of the measures.  

Part Three: Statements and Matters of Particular Interest to Parliament 

11. Matters of special interest to Parliament  

11.1. Section 49(3) of the Act requires that ‘a public authority must have regard to the code of practice in disclosing information under section 45’. Therefore, we intend to commence section 45 of the Act once the Code has been published. 

12. European Convention on Human Rights 

12.1. The Parliamentary Under-Secretary of State has made the following statement regarding Human Rights: “In my view the provisions of the code of practice for public authorities sharing data with digital verification services are compatible with the Convention rights.” 

13. The Relevant European Union Acts 

13.1. This instrument is not made under the European Union (Withdrawal) Act 2018, the European Union (Future Relationship) Act 2020 or the Retained EU Law (Revocation and Reform) Act 2023 (“relevant European Union Acts”).