UK Parliament receives draft Digital identity code

On October 21, 2026, Parliament received a draft code of practice under Section 49 of the Data (Use and Access) Act 2025, and the Department for Digital, Culture, Media and Sport and the Office for Digital Identities and Attributes prepared it jointly, Tech Times reported.

The department still struggles to define what digital identity means, according to Tech Times. The draft code enables certified Digital Verification Service providers to query government biometric records in real time if both houses approve. Parliament must pass a resolution in each House approving the draft before the information gateway power can commence. The power sits in Section 45 of the Data (Use and Access) Act 2025.

Tech Times reported that officials are targeting approval and commencement before the end of 2026. The Office for Digital Identities and Attributes aims to complete Parliament’s approval before the end of the year, and to commence Section 45 at the same moment the final code is published. Commencement is tied to publication of the final code. The information gateway and the code of practice would effectively go live simultaneously.

Once both Houses approve, certified Digital Verification Service providers may query government databases holding biometric records in real time on behalf of individuals requesting identity checks, Tech Times said. The gateway confirms specific facts such as age, identity, or status using the minimum data necessary rather than full identity records. Whether that principle holds in practice remains a central governance question as use cases multiply. The code recommends that a public authority put a data sharing agreement in place with a Digital Verification Service provider before information changes hands.

Data may be released through an application programming interface, as a verifiable credential, or by other agreed means, according to Tech Times. UK GDPR classifies facial images and fingerprint records processed to uniquely identify a natural person as special category personal data. Sharing biometric data requires a lawful basis under Article 6(1) of the UK GDPR and satisfaction of one condition under Article 9 and, where relevant, Data Protection Act Schedule 1. The Information Commissioner’s Office is transitioning to the Information Commission from September 30, 2026.

Tech Times said that the Information Commission retains enforcement jurisdiction over Digital Verification Service providers’ data protection compliance. The first phase of gateway commencement excludes HMRC, Revenue Scotland, and the Welsh Revenue Authority. The public DVS services register lists 65 services from 48 certified providers as of Oct. 2026. Certified providers carry the UK CertifID trust mark issued by the Office for Digital Identities and Attributes.

The DVS Trust Framework version 1.0 was published in June 2026 and took effect on September 2, 2026, Tech Times reported. GOV.UK Wallet sandbox guidance was published in September 2026, letting certified Digital Verification Service providers begin technical integration testing ahead of production launch. The Office for Digital Identities and Attributes sectoral analysis 2026, published in July 2026, identified 275 UK firms offering digital identity products and services. Annual revenue reached £2.027 billion, approximately $2.716 billion, and gross value added reached £1.037 billion, approximately $1.388 billion, Tech Times said.

Adoption across relevant sectors reached 77%, Tech Times said. Currency conversions use an exchange rate of 1 GBP = $1.3393 USD as of October 22, 2026 and are approximate. In July 2026, Prime Minister Andy Burnham’s government dissolved the Department for Science, Innovation and Technology. Digital identity policy moved to a reinstated Department for Digital, Culture, Media and Sport under Secretary of State Lisa Nandy.

Tech Times said that DCMS Permanent Secretary Susannah Storey told the House of Commons Public Accounts Committee that the reorganization is digital mainstreaming. Sarah Munby, former Permanent Secretary of the Department for Science, Innovation and Technology, warned of fragmentation risks from separating data, digital, and AI functions. She acknowledged knotty coordination is now required across the Cabinet Office, the Department for Business, Innovation, Science and Technology, and DCMS. Lord Tarassenko, speaking in the House of Lords, said the transition would take around a year and described a year as an eternity in AI.

Comparable regimes operate across Scandinavia and are advancing in the European Union under the eIDAS 2.0 EU identity regulation, Tech Times reported. The UK architecture combines a trust framework, public register, government wallet, and statutory data-sharing code.