I2 S. 1 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904 , reg. 2(a)
Data regulations U.K.
2 Power to make provision in connection with customer data U.K.
(1) The Secretary of State or the Treasury may by regulations make provision requiring a data holder to provide customer data—
(a) to the customer, at the customer’s request, or
(b) to a person of a specified description who is authorised by the customer to receive the data (an “authorised person”), at the customer’s request or at the authorised person’s request.
(2) In this Part, in relation to customer data, “ third party recipient ” means a person of a description specified by provision made under subsection (1)(b) (and see section 25(1)).
(3) The Secretary of State or the Treasury may by regulations make provision enabling or requiring a data holder—
(a) to produce, collect or retain, or arrange for the production, collection or retention of, customer data;
(b) to make changes to customer data, including to require rectification of inaccurate customer data, at the request of a customer or authorised person.
(4) The Secretary of State or the Treasury may by regulations make provision for a person who is an authorised person in relation to customer data to take, on the customer’s behalf, action that the customer could take in relation to goods, services or digital content supplied or provided by a person who is, or has been, a data holder in relation to the customer data.
(5) In deciding whether to make regulations under this section, the Secretary of State or the Treasury must have regard to (among other things)—
(a) the likely effects for existing and future customers,
(b) the likely effects for data holders,
(c) the likely effect on small businesses and micro businesses,
(d) the likely effect on innovation in the supply or provision of goods, services and digital content affected by the regulations or other goods, services and digital content, and
(e) the likely effect on competition in markets for goods, services and digital content affected by the regulations or other markets.
I3 S. 2 in force at Royal Assent for specified purposes, see s. 142(1)(2) (h)
I4 S. 2 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904 , reg. 2(a)
3 Customer data: supplementary U.K.
(1) This section is about provision that regulations under section 2 may (among other things) contain.
(2) The regulations may include—
(a) provision about the procedure by which customers authorise persons to receive customer data or to do other things;
(b) provision restricting the persons that may be authorised to persons that comply with specified conditions;
(c) provision for a specified person to decide whether a person satisfies the conditions for authorisation (and see section 6 for further provision about decision-makers).
(3) The regulations may make provision about requests relating to customer data, including provision about the circumstances in which a data holder may or must refuse to act on a request.