The final publication of the ‘gamma’ (0.4) UK digital identity and attributes trust framework is now live on GOV.UK. It is accompanied by updated versions of the additional rules – which we call supplementary codes – for digital right to work, right to rent, and Disclosure and Barring Service (DBS) identity checks.
This post explains what that means for digital verification service (DVS) providers.
Why we pre-released the gamma publication
We pre-released the gamma publication of the trust framework in November 2024. This was intended to give you certainty about the incoming requirements and time to prepare to meet them. We’ve previously posted about the five main changes we made for gamma.
In the meantime, we’ve been updating the certification scheme and its associated documentation to align with the gamma publication, so that it can be ‘recognised’ (i.e. approved) by the UK Accreditation Service (UKAS), ready for independent certification.
This process is now complete. That means approved CABs may begin certifying services in line with the new rules from 1 July 2025. Today, we have therefore republished gamma, clearly relabelling it as the final publication.
Changes between pre-release and final
We did not expect to make changes to gamma between the November pre-release and its final ‘certification ready’ publication – except for alterations to the enforcement and expiry dates in Section 0.
However, we have ended up needing to make a few (mostly cosmetic) adjustments to ensure requirements continue to work as intended. These are clearly listed at the beginning of the final publication, and include:
- correcting several out-of-date links;
- tweaking wording in 4.4.c. and Illustrative Examples 1 and 9, now that supplementary codes are no longer ‘pilots’;
- replacing a link in 12.4.a. to the ‘Government Internal Audit Agency’s standards’, which were withdrawn in May, with the ‘Government Functional Standard GovS 009: Internal Audit’ which supersedes them;
- correcting a typo which referred to the ICO’s guidance on ‘privacy by design and default’, rather than ‘data protection by design and default’; and
- replacing two links to draft ICO guidance on anonymisation with a link to the final version, which was published in March.
What this means for your trust framework certification
The gamma publication of the trust framework formally comes into force from 1 July 2025. This means that any new certifications or recertifications that occur after this date should be made against the newly UKAS-recognised publications.
As outlined in Section 0, any existing certifications against the beta (0.3) version of the trust framework will remain valid until 31 March 2026 – or else until a service either uplifts to the gamma or its beta certification expires; whichever is soonest.
If you wish to remain certified after this date, you should contact your CAB to arrange the uplift of your service to gamma as soon as possible. This will ensure you are following the most up-to-date requirements and that your service can continue to appear on the DVS Register.
What this means for services following supplementary right to work, rent and DBS rules
Alongside gamma, we have also introduced newly reformatted publications of the ‘supplementary codes’ for digital right to work, rent and DBS identity checks, in line with the terminology used in the Data (Use and Access) Act.
These standalone supplementary code publications copy and replace the rules for DVS which were previously contained within Home Office and DBS guidance documents. That Home Office and DBS guidance has been republished without the DVS-facing rules, and is now specifically aimed at relying parties in those use cases.
Although the codes are now formatted differently and in standalone documents, the certifiable rules for DVS are unchanged, so you should not need to change your services to meet the requirements. Existing right to work, rent and DBS certifications as part of the beta (0.3) trust framework will also remain valid until 31 March 2026.
Like with the trust framework, any new certifications or recertifications after 1 July 2025 should consequently be made against these new publications. This uplift cannot precede a service’s uplift to the gamma trust framework, but can be done in parallel.
Towards the next iteration of the trust framework
If you’re already certified, please read more about uplifting your service to the gamma publication and updated supplementary codes. If you’re interested in becoming certified, you can learn more on our registration and certification page.
We’re also still developing the 1.0 publication, which we intend to publish as a pre-release soon after the Data Act commences later this year. You can get involved with 1.0’s development at our upcoming OfDIA engagement day in July. We’ll share more information about how to join this event shortly.
Leave a comment