Draft code laid on public bodies sharing data with digital ID checkers

A draft code of practice on how public authorities may share information with digital verification services was published on 21 October and laid before Parliament. It was published by the Department for Digital, Culture, Media and Sport and the Office for Digital Identities and Attributes.

Digital verification services check facts about a person, such as their age or identity, so the person does not have to show the same documents again and again. The draft code concerns the point at which a public authority holds information that could help such a check.

The legal basis

The code is issued under section 49 of the Data (Use and Access) Act 2025. Section 45 of the same Act creates what the government calls an information gateway. It allows public authorities to share information with providers of digital verification services.

The gateway is narrow. A provider must be certified against the digital verification services trust framework and listed on the statutory register created under section 32 of the Act. Information can be shared only for the purpose of providing a verification service, and only at the request of the individual concerned.

What the code covers

The draft has four sections. The first is an overview. The second sets out the legal powers. The third covers other relevant law, including the UK General Data Protection Regulation. The fourth describes the process a public authority should follow.

That process includes putting a data sharing agreement in place, checking that information is accurate and sharing no more than is needed. The code points to guidance from the Information Commissioner's Office on data sharing rather than repeating it.

Who was consulted

The code applies across the United Kingdom. A Welsh language version has been published alongside the English text. The Information Commission and the devolved governments were consulted, and external groups were consulted in March 2026.

What happens next

The draft must be approved by each House of Parliament before it takes effect. Once the code is published in final form, the government intends to commence section 45, which switches on the gateway itself.

Separate non-statutory guidance is expected later this year. The first annual report on Part 2 of the Act, the part dealing with digital verification services, was published in July 2026.

The impact assessment prepared for the Act estimated net benefits of between £1.3 billion and £6.2 billion over 10 years from the measures as a whole. That estimate covers more than this code.

At the person's request

Sharing under the gateway is tied to a request from the person whose information is involved. Public authorities must have regard to the code when they share information in this way.