The majority of the measures in Part 2 of the Data (Use and Access) Act 2025 have come into force today, 1 December 2025. This move brings the digital verification services (DVS) pilot onto a statutory footing, enabling people and businesses to have greater confidence when using DVS to prove who they are or things about them.
Moving to a statutory framework
Since 2020, the government has operated a pilot to enable the secure and reliable use of digital verification services in the UK. The pilot approach included creating the UK digital identity and attributes trust framework (the trust framework), supplementary codes, an independent certification process, and a register of certified DVS providers.
We’ve tested, learnt from and improved these interventions over time, in preparation for moving to a statutory regime. For example, in April 2025, we launched a GOV.UK service for the public register, replacing the manual publication of spreadsheets of providers and their services. We’ve continued – and continue – to improve that service over time.
In June 2025, we published the final release of the ‘gamma’ (0.4) trust framework and the first publications of the right to work, rent and DBS supplementary codes.
Just last month, in November 2025, the UK Accreditation Service granted its first accreditation to an approved conformity assessment body.
These were essential elements to have gotten right and to ensure they were operationally ready prior to commencement. They now are, so the DVS measures in the Data (Use and Access) Act – which became law in June – can now come into force as the next step. That means that, from today, many aspects of the pilot have been placed onto a statutory footing.
Why have we brought this in
Taken as a whole, this regime of standards, governance and oversight helps to ensure the public can trust digital verification services offered under it in the UK.
Certification against the trust framework is optional, but it enables providers to appear on the new statutory register. This helps the public and businesses across the economy to more easily identify a DVS provider as trustworthy. By strengthening the reliability of the industry through a statutory regime, we pave the way for increased use of trusted digital identities by the public.
What this means for you
Now we have moved to the statutory regime, service providers and conformity assessment bodies should now refer to the most recently republished versions of the trust framework and supplementary codes, which we have updated to reflect that these are the statutory versions.
Existing certification against the trust framework or any of the existing supplementary codes remain valid in line with the provisions in section 0 of the most recent republished version of the trust framework (0.4).
In addition, 48 DVS providers and their 57 services that had gained certification against the trust framework have applied to join the statutory DVS register. The statutory register is now live and replaces the non-statutory register from today.
We have also published new guidance on how providers can apply to appear on the statutory register, which providers should refer to moving forwards.
What comes next?
In line with the duties under the Act passed in June, we must review the supplementary codes and trust framework at least every year, as well as publish a report on the regime’s performance. We intend to publish the 1.0 version of the trust framework in 2026, starting with a pre-release, which we will then work with conformity assessment bodies and the UK Accreditation Service to enable certification against.
Certification against the 1.0 publication will allow DVS providers to use the trust mark. This trust mark will enable the public to identify trustworthy reliable DVS providers more readily.
Additionally, we intend to bring into force the remaining powers in the Act relating to the information gateway. These powers will allow public authorities to share relevant information about an individual with a registered DVS provider for the purposes of providing digital verification services to that individual at their request.
Reminder
All certificates issued against the beta (0.3) publication of the trust framework will forcibly expire on 31 March 2026. Service providers that wish to maintain their certification must uplift to the gamma (0.4) publication before 31 March 2026.
Leave a comment