Digital Inclusion Action Plan: One Year On
Why linked: Digital Inclusion Action Plan: One Year On report — inclusion context for the regime.
In response to: Digital Inclusion Action Plan: One Year On
The UK digital identity regime now has three linked layers: the statutory DVS trust framework and register under Part 2 of the Data (Use and Access) Act 2025; the Cabinet Office-led national Digital ID built on GOV.UK One Login; and the Digital Access to Services Bill announced in the 13 May 2026 King's Speech, which is intended to establish the legal framework for creating, issuing and using that national credential across public services and priority wider-economy use cases including digital right-to-work checks.
Digital ID is being positioned both as a productivity and public services reform (removing repeated identity proofing across HMRC, DWP, Companies House and the Veteran Card) and as an illegal-working enforcement tool (mandatory for right-to-work checks). It interlocks data protection, immigration enforcement, accessibility/digital inclusion and competition policy, and is now subject to live national consultation (CP 1498).
Part 2 of the DUAA is already in force for the DVS framework and register, while the national Digital ID scheme has moved from roadmap and consultation into the 2026 legislative programme. The King's Speech announced the Digital Access to Services Bill as the vehicle for national Digital ID, public-service access through the GOV.UK app, public-sector join-up and priority uses such as digital right-to-work checks.
Royal Assent 19 June 2025. Part 2 establishes the statutory DVS trust framework, register, supplementary codes, information gateway and trust mark.
10 March 2026 consultation document setting out the national Digital ID scheme for British and Irish citizens and resident foreign nationals.
Sections 27–55 confer the powers under which OfDIA maintains the trust framework, runs the DVS register and designates the UK CertifID trust mark.
Pre-DUAA data-sharing objective enabling cross-government identity verification under Part 5 of the Digital Economy Act 2017.
First revised statutory trust framework under the DUAA; renames the gamma 0.4 framework, narrows scope to natural persons and introduces the UK CertifID trust mark.
Pre-release supplementary code under DUAA s.29 setting rules for DVS providers serving employers' right-to-work checks — the priority mandatory use case.
Rules for DVS supporting Registered Bodies and Responsible Organisations conducting Disclosure and Barring Service identity checks.
Rules for DVS supporting landlords undertaking digital right to rent checks.
Commenced Part 2 of the DUAA (except ss.45–48 information gateway) on 1 December 2025, switching on the statutory DVS regime.
GDS account of how One Login implements the Identity Assurance Principles; underpins migration of departmental services to the single sign-on.
Technical schema for DVS providers and relying parties to exchange identity, attribute and confidence-level metadata consistently.
OfDIA guidance on applying to and maintaining a listing in the statutory DVS register established under DUAA s.32.
Transfers lead responsibility for Digital ID to the Cabinet Office.
Cabinet Office explainer published alongside the March 2026 consultation.
Progress report on the cross-government Digital Inclusion Action Plan — the principal accessibility backdrop against which mandatory Digital ID is being designed.
Library briefing explaining the national Digital ID consultation, the DVS regime and outstanding policy questions.
Committee evidence session noting >3,500 written submissions, the bulk from members of the public, on the national Digital ID proposals.
Costs/benefits of smart data, DVS, data protection reforms and connected measures at enactment.
Bill-stage impact assessment for Part 2 of what became the DUAA.
OfDIA findings on inclusion performance of certified services — required reading on accessibility risk.
OfDIA market and consumer-insight analysis of the UK digital identity sector.
Defines the core proposition (free government credential, mandatory for right-to-work, integrated with One Login) of the national Digital ID layer.
Right-to-work checks are the priority mandatory use case for the Digital ID credential and the DVS supplementary code.
Original policy development consultation underpinning the DVS framework legislated in DUAA Part 2.
Source of the six 'digital identity principles' explicitly referenced in the DVS trust framework 1.0.
Tracks the data-protection guidance DVS providers must operate against.
A new digital ID scheme will help combat illegal working while making it easier for the vast majority of people to use vital government services.
Why linked: Defines the dual-objective political framing under which CP 1498 and the One Login expansion are being progressed.
A new cross-government scheme, led by the Cabinet Office, will make a free and secure digital credential available to all UK citizens.
Why linked: Sets the formal cross-government 2025–2030 trajectory for the national Digital ID layer.
I am making this statement to bring to the House's attention the following Machinery of Government update.
Why linked: Reorganises lead departmental responsibility for the national Digital ID scheme — the institutional anchor of the policy.
The Digital Inclusion Action Plan aims to close the digital divide in the UK.
Why linked: Government commits to a digital inclusion programme that will be load-bearing for the legitimacy of any mandatory Digital ID.
These Regulations relate to the disclosure of information in relation to public service delivery, pursuant to Chapter 1 of Part 5 of the Digital Economy Act 2017.
Why linked: The immediate Conservative-era statutory predecessor to the DUAA s.45 information gateway, retained by the current government.
Why linked: Digital Inclusion Action Plan: One Year On report — inclusion context for the regime.
In response to: Digital Inclusion Action Plan: One Year On
Why linked: Filled the "GOV.UK One Login technical roadmap and integration specifications" gap via web research
The official technical documentation hub for GOV.UK One Login, covering integration specifications for authentication (OIDC/Authorization Code Flow), identity proving, environment setup, and API endpoint details for government service teams onboarding to One Login.
Why linked: Filled the "GOV.UK One Login roadmap and integration strategy" gap via web research
Official GDS technical documentation explaining how government service teams integrate with GOV.UK One Login, covering the end-to-end proof-of-concept and integration environment process. It forms the practical integration strategy guidance for onboarding services to One Login.
Why linked: Smart Data scheme consultation under DUAA 2025 – related data-sharing framework emerging from same statutory basis
We are seeking views on whether and how to introduce a Smart Data scheme in digital markets, using the new powers provided under the Data (Use and Access) Act 2025.
Why linked: GOV.UK One Login app identity verification guidance – core implementation material for digital credential system
How to use the GOV.UK One Login app to prove your identity, including how to download the app and how to scan your face and photo ID.
Why linked: DUAA commencement regulations (No. 6) for data protection provisions, Part 5 focused but contextually relevant
DUAA commencement regulations (No. 6) for data protection provisions, Part 5 focused but contextually relevant
In response to: Making public services work for you with your digital identity
Why linked: Filled the "Right to Work checks implementation and integration timelines" gap via web research
This consultation seeks views on a proposed national digital ID system for British and Irish citizens and foreign nationals with permission to be in the UK.
Why linked: DVS trust framework data schema 1.0 — interoperability standard underpinning the regime.
A specification to help DVS and relying parties organise and exchange information in a consistent way to enable interoperability
Why linked: Privacy notice for the DVS register — operational DP compliance artefact.
This notice sets out your rights and how we will process your personal data. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR).
Why linked: ICO consultation on automated decision-making guidance - relevant to data protection framework for digital identity services
The Information Commissioner’s Office (ICO) is consulting on draft guidance about automated decision-making, including profiling . This guidance serves as an update to existing guidance on automated decision-making and profiling. The updates to our guidance follow the introduction of the …
Why linked: DUAA 2025 Consequential Amendments and Transitional Provision Regulations 2026 – statutory instrument implementing legislative framework for digital verification services
These Regulations make various amendments to legislation in consequence of sections 117, 118 and 119(1) of the Data (Use and Access) Act 2025 (c. 18) (“the 2025 Act”). Those sections establish the Information Commission as a body corporate, abolish the …
Why linked: GOV.UK One Login app accessibility statement - implementation document for key delivery channel of Digital ID scheme
How we've tested the accessibility of the GOV.UK One Login app, issues we've found, and how you can report problems.
Why linked: GOV.UK app accessibility statement - accessibility compliance for integrated Digital ID delivery platform
Find out how accessible the GOV.UK app is and how to tell us about accessibility problems.
Why linked: ICO guidance tracker on DUAA implementation – regulatory guidance emerging from statutory framework
The ICO's live tracker of all guidance being updated or created in response to the DUAA, including publication stages, consultation status, and expected publication dates through Summer 2026.
Why linked: Matched expansion phrase: Digital Inclusion Action Plan
Progress report on delivering the Digital Inclusion Action Plan.
Why linked: GOV.UK app terms and conditions - policy document for integrated Digital ID delivery platform
This page and any pages it links to explains terms of use for the GOV.UK app. You must agree to these to use the GOV.UK app.
Why linked: Victims and Prisoners Act 2024 / DUAA 2025 Commencement No. 8 Regulations – statutory instrument with DUAA commencement provisions
These Regulations bring into force specified provisions of the Victims and Prisoners Act 2024 (c. 21) (“the 2024 Act”) and the Data (Use and Access) Act 2025 (c. 18) (“the 2025 Act”) on 31st March 2026. These are the tenth …
Why linked: Cabinet Office Digital ID scheme explainer (March 2026) — public-facing framing of the regime.
How a digital ID scheme will make it easier for people in the UK to use government services and help secure our borders.
Why linked: GOV.UK One Login security code guidance – operational/user-facing guidance for credential access
How to get a security code to sign in to your GOV.UK One Login and what to do if you're having problems receiving a code.
Why linked: The full consultation document containing detailed technical and policy proposals for the national digital ID scheme.
Above all, the digital ID will be useful. It will help people to prove who they are and things about themselves, like their age, in the public and private sectors.
Why linked: Supplementary code for digital right-to-work checks (1.0) – mandatory employment verification implementation specification
A pre-release of the next version of the supplementary code for digital right to work checks
Why linked: Pre-release of the next version of the supplementary code for DBS digital identity checks.
A pre-release of the next version of the supplementary code for Disclosure and Barring Service digital identity checks
Why linked: Guidance on checking delegated authority under the DVS framework 1.0.
Guidance for services certified against the UK digital verification services trust framework who offer delegated authority as part of their service.
Why linked: Guidance on creating, binding and sharing attributes under the DVS framework 1.0.
Guidance on creating, binding, scoring and sharing attributes for organisations certified against the UK digital verification services trust framework as an attribute service provider, or interested in understanding more about attributes.
Why linked: Pre-release guidance for UK DVS trust framework 1.0 — operational continuity from gamma (0.4).
A pre-release of the next version of the UK digital verification services trust framework.
Why linked: 1.0 pre-release of the renamed UK DVS trust framework (6 March 2026) — the post-statutory operational baseline.
This is the 1.0 publication of the DVS trust framework, renamed to align with the Data (Use and Access) Act 2025; it is described as a pre-release pending UKAS accreditation of conformity assessment bodies.
Why linked: DVS guidance on Money Laundering Regulations integration—directly relevant to regulated private-sector identity verification use case within thread scope
The guidance sets out how entities regulated under the Money Laundering Regulations can use digital verification services for customer due diligence checks.
Why linked: Matched expansion phrase: Online Safety Act 2023
Seeking views on possible amendments to the Tribunal Procedure (Upper Tribunal) Rules 2008 in respect of appeals under the Online Safety Act 2023.
Why linked: DUAA implementation guidance on complaints procedure requirements—statutory deadline and operational framework for DVS providers
With the complaints procedure deadline approaching on 19 June 2026, organisations must adopt written complaints-handling policies, establish accessible submission channels, and train staff; the ICO proposes outcomes should be provided within three months.
Why linked: Download the GOV.UK app guidance - core implementation delivery document
Get faster access to the government information and services by using the GOV.UK app. Find out how to download the GOV.UK app, and what the app does.
Why linked: Digital Economy Act 2017 (Commencement No. 2) and DUAA 2025 (Commencement No. 7) Regulations 2026 - brings into force provisions for digital verification services framework
These Regulations bring into force specified provisions in the Digital Economy Act 2017 (“the 2017 Act”) and the Data (Use and Access) Act 2025 (“the 2025 Act”).
Why linked: HMRC integration with GOV.UK One Login – key public service access implementation
Find out how GOV.UK One Login will apply to you and when you can expect to start using it.
Why linked: GOV.UK One Login account management guidance – essential user-facing operational documentation
How to change the password, phone number, email address and how you get security codes for your GOV.UK One Login.
Why linked: DUAA 2025 Commencement No. 5 Regulations – statutory instrument for Sexual Offences Act amendments tied to digital verification framework
Section 138 of the DUAA comes into force on 6 February 2026, inserting new offences into the Sexual Offences Act 2003 relating to creating or requesting purported intimate images of an adult without consent.
Why linked: DUAA 2025 commencement plans – government's statutory roadmap for bringing digital ID framework into force
A summary of the government’s plans for bringing into force provisions in the Data (Use and Access) Act 2025.
Why linked: DUAA 2025 Commencement No. 6 Regulations (data protection provisions) – statutory instrument bringing forward Part 5 data protection rules underlying digital ID system
These Regulations bring into force the majority of the data protection and privacy provisions in Part 5 of the DUAA on 5 February 2026, including changes to UK GDPR, PECR, and the Data Protection Act 2018.
Why linked: Statutory Instrument: DUAA Commencement No. 6 bringing key provisions into force—core legislative instrument for digital ID and DVS framework
These are the sixth commencement regulations made under the Data (Use and Access) Act 2025 (c. 18) (“the 2025 Act”).
Why linked: GOV.UK One Login privacy notice – mandatory transparency document for digital credential system data handling
Find out how GOV.UK One Login collects and uses your data.
Why linked: GOV.UK One Login identity verification via security questions – operational guidance for credential proof methods
What to do if you're having problems proving your identity with GOV.UK One Login using security questions.
Why linked: Data (Use and Access) Act 2025 (Commencement No. 5) Regulations 2026 - statutory instrument commencing DUAA provisions
These are the fifth commencement Regulations made under the Data (Use and Access) Act 2025 (c. 18) (“the Act”).
Why linked: Data (Use and Access) Act 2025 (Commencement No. 5) Regulations 2026 - statutory instrument commencing DUAA provisions
These are the fifth commencement Regulations made under the Data (Use and Access) Act 2025 (c. 18) (“the Act”).
Why linked: Filled the "Public service digital accessibility and inclusion guidance" gap via web research
Find the best guidance and tools to meet the accessibility regulations.
Why linked: The government's official Roadmap page for digital ID, setting out delivery milestones and governance arrangements.
A new cross-government scheme, led by the Cabinet Office, will make a free and secure digital credential available to all UK citizens and everyone with right to be in the UK.
Why linked: Filled the "UK digital identity trust framework and provider accreditation standards" gap via web research
Conformity assessment bodies must follow these processes and requirements when certifying services against the UK digital identity and attributes trust framework.
Why linked: Motor Fuel Price (Open Data) Regulations 2025 made under DUAA Part 1 — confirms DUAA's smart-data Part 1 is now operational alongside Part 2 and is part of the wider regime architecture.
These Regulations establish an open data scheme under Part 1 of the Data (Use and Access) Act 2025 (c. 18) in relation to the price of motor fuel. The scheme will be administered by a person appointed by the Secretary …
Why linked: Data (Use and Access) Act 2025 (Consequential and Other Amendments) Regulations 2025 - statutory instruments implementing DUAA
These Regulations make amendments which are consequential on provisions in the Data (Use and Access) Act 2025 (c. 18) (“the 2025 Act”). They also make related changes in relation to recordable offences.
Why linked: Operational guidance on using the DVS register — public-facing implementation of s.32 DUAA.
How to use the register of digital identity and attribute services.
Why linked: Operational guidance on joining the DVS register — implementation of s.33 DUAA.
How to apply to join the register and keep your information up to date.
Why linked: Statutory supplementary code for DBS digital identity checks.
This publication sets out rules for digital verification services supporting Registered Bodies and Responsible Organisations to conduct identity verification as part of Disclosure and Barring Service checks.
Why linked: Statutory supplementary code for digital Right to Rent checks.
This publication sets out rules for digital verification services supporting landlords who choose to conduct digital right to rent checks.
Why linked: Statutory supplementary code for digital Right to Work checks — central to mandatory-RtW commitment.
This publication sets out rules for digital verification services supporting employers who choose to conduct digital right to work checks.
Why linked: GOV.UK page on plans for commencement of DUAA Part 2 — operationalising guidance for the live regime.
The Data (Use and Access) Act 2025 (Commencement No. 4) Regulations 2025 bring into force the majority of the measures in Part 2 on 1 December 2025, placing the digital identity trust framework on a statutory footing.
Why linked: Filled the "UK digital identity trust framework and provider accreditation standards" gap via web research
The most recent version of the UK digital identity and attributes trust framework.
Why linked: Statutory Instrument: DUAA Commencement No. 4—primary legislation commencement relevant to digital ID statutory framework
These are the fourth commencement regulations made under the Data (Use and Access) Act 2025 (c. 18) (“the Act”).
Why linked: The commencement SI that brought the DVS statutory framework into legal force, a key implementation milestone for digital ID.
Part 2 of the Data (Use and Access) Act 2025 (digital verification services), except sections 45 to 48, comes into force on 1st December 2025.
Why linked: GOV.UK app privacy notice - data protection compliance for core delivery platform
What data we collect from you when you use the GOV.UK app, what we do with your data, how long we keep it for, and how we protect it and keep it secure.
Why linked: Data (Use and Access) Act supporting documents — Royal Assent impact materials.
Supporting documents assessing the impact of the Data (Use and Access) Act 2025 which received Royal Assent on 19 June 2025.
Why linked: Right to Work Scheme consultation—mandatory credential use case for employment verification, core thread priority
The government is consulting with employers on extending right to work checks to the 'gig economy' to prevent illegal working.
Why linked: Data Protection Act 2018 (Qualifying Competent Authorities) Regulations 2025 - statutory instrument for data protection framework
Sections 89 and 90 of the Data (Use and Access) Act (c. 18) (“the DUAA”) amend the Data Protection Act 2018 (c. 12) (“the DPA”) to enable joint processing between qualifying competent authorities and intelligence services, under Part 4 of …
Why linked: Data Protection Act 2018 (Qualifying Competent Authorities) Regulations 2025 - enables joint processing for digital identity data sharing
Sections 89 and 90 of the Data (Use and Access) Act (c. 18) (“the DUAA”) amend the Data Protection Act 2018 (c. 12) (“the DPA”) to enable joint processing between qualifying competent authorities and intelligence services, under Part 4 of …
Why linked: Document storage in GOV.UK One Login app – credential system functionality and terms
The terms and conditions you must agree to when you save a digital document to your GOV.UK One Login app.
Why linked: GOV.UK Wallet guidance for trust framework certified organisations—technical integration for digital credential storage and use
Organisations certified against the trust framework will be able to use the information in GOV.UK Wallet.
Why linked: Digital Veteran Card integration with GOV.UK One Login app – credential document storage implementation
What to do if you get stuck adding your digital Veteran Card to the GOV.UK One Login app, including how to download the app and find the QR code or button to add your card.
Why linked: Assisted access to GOV.UK One Login – accessibility and inclusion guidance for credential adoption
What you can and cannot do when you help someone you know create a GOV.UK One Login and prove their identity.
Why linked: GOV.UK One Login deletion guidance – user control and data management within credential system
How to delete your GOV.UK One Login, and what happens if you do this.
Why linked: Data (Use and Access) Act 2025 (Commencement No. 2) Regulations 2025 - brings into force DUAA provisions
These Regulations bring into force section 124 of the Data (Use and Access) Act 2025 (c. 18) (“the 2025 Act”). These are the second commencement regulations made under the Act.
Why linked: Statutory Instrument: DUAA Commencement No. 2—legislative commencement for data preservation notices
These Regulations bring into force section 124 of the Data (Use and Access) Act 2025 (c. 18) (“the 2025 Act”). These are the second commencement regulations made under the Act.
Why linked: Statutory Instrument: DUAA Commencement No. 3 with transitional provisions—core legislative commencement
These are the third commencement Regulations made under the Data (Use and Access) Act 2025 (c. 18) (“the 2025 Act”).
Why linked: ICO launches consultations on DUAA 2025 amendments - guidance development for statutory framework
The ICO launched public consultations on draft guidance for 'recognised legitimate interest' and 'data protection complaints', with an eight-week consultation closing on 19 October 2025.
Why linked: Statutory Instrument: DUAA Commencement No. 1 bringing Part 1 and specified Part 5 provisions into force—foundational commencement
These Regulations bring into force specified provisions of the Data (Use and Access) Act 2025 on 20 August 2025, including Part 1 (Smart Data) and specified provisions in Part 5 amending UK GDPR and PECR.
Why linked: Licensing authority guide to right to work checks—implementation guidance for mandatory digital right-to-work verification
Guidance for licensing authorities on how to check the immigration status of people who apply for a taxi or private hire licence.
Why linked: Filled the "Right to Work checking regime and employer guidance" gap via web research
How to carry out right to work checks, why you need to do them, and which documents you can use.
Why linked: GOV.UK guidance on Conformity Assessment Bodies under the DVS framework — operationalises s.33(6) DUAA.
Find out who can certify digital identity services during the pilot process, and more about the approval and accreditation process.
Why linked: Data (Use and Access) Act 2025 (Commencement No. 1) Regulations 2025 - first commencement of DUAA
These Regulations bring into force specified provisions of the Data (Use and Access) Act 2025 (c. 18) (“the Act”) on 20th August 2025. They are the first Commencement Regulations made under the Act. Certain provisions were brought into force automatically …
Why linked: Closed consultation on the Digital Inclusion Action Plan.
We are seeking views on the Digital Inclusion Action Plan.
Why linked: Summary of responses to the Digital Inclusion Action Plan consultation.
Summary of responses to the Digital Inclusion Action Plan consultation.
In response to: Digital Inclusion Action Plan
Why linked: Official factsheets on the Data (Use and Access) Act 2025, which is the primary statutory basis for the Digital Verification Services trust framework and digital identity provisions in scope.
Factsheets about the Data (Use and Access) Act 2025 which received Royal Assent on 19 June 2025.
Why linked: Summary of data protection and privacy changes in the DUAA 2025, directly relevant to understanding the regulatory framework for digital verification services and digital identity.
A summary of changes to the UK’s data protection and privacy legislation in the Data (Use and Access) Act.
Why linked: ICO guidance on DUAA 2025 implementation and compliance, regulator interpretation of the statutory framework for digital verification services and data protection.
The DUAA amends but does not replace the UK GDPR, DPA 2018, and PECR; changes will be phased in between June 2025 and June 2026, with the ICO updating guidance over time as provisions come into effect.
Why linked: ICO Hub Page on Data (Use and Access) Act 2025 - regulator's central guidance on statutory framework for digital verification services
The ICO's central hub for DUAA guidance, covering what the Act means for organisations, law enforcement, and the public, with links to all published and forthcoming guidance.
Why linked: The Data (Use and Access) Act 2025 itself (legislation.gov.uk version), the primary statutory instrument establishing the DVS trust framework and digital verification powers in scope.
The Act received Royal Assent on 19 June 2025 and amends the UK GDPR, the Data Protection Act 2018, and PECR across seven Parts covering smart data, digital verification, data protection reform, and ICO restructuring.
Why linked: Parliamentary Bill page for the Data (Use and Access) Act 2025, legislative history and procedural document relevant to understanding the policy development.
A bill to make provision about services consisting of the use of information to ascertain and verify facts about individuals; to make provision about the recording and sharing of information.
Why linked: Enactment Impact Assessment for the DUAA — quantitative basis for DVS regime costs and benefits.
The full impact assessment for the DUAA at enactment, covering costs and benefits of smart data, digital identity, data protection reforms, and adequacy risk, including analysis of UK-EU trade impacts.
Why linked: Foundational instrument: Part 2 DUAA on legislation.gov.uk — directly governs the regime.
Part 2 contains provision to secure the reliability of digital verification services; the Secretary of State must prepare and publish the DVS trust framework.
Why linked: HM Land Registry enhanced digital identity verification guidance (PG81) — regulatory and implementation guidance for digital verification services in regulated sector
Information about HM Land Registry’s enhanced level of digital identity verification (practice guide 81).
Why linked: GOV.UK app testing privacy notice is relevant as the GOV.UK app is explicitly named in scope as a linked delivery mechanism for digital ID credential access.
What data we collect from you when you sign up to test the GOV.UK app, what we do with your data, how long we keep it for, protect it and keep it secure.
Why linked: Digital Inclusion Action Plan: First Steps — published policy paper.
Digital Inclusion Action Plan: First Steps — published policy paper.
In response to: Digital Inclusion Action Plan: First Steps
Why linked: Filled the "Public service digital accessibility and inclusion guidance" gap via web research
The Digital Inclusion Action Plan aims to close the digital divide in the UK, ensuring that the benefits of technology can be felt by all.
Why linked: Official government blog tracking the Bill's parliamentary progress, providing a contemporaneous record of the legislative journey.
The Data (Use and Access) Bill has finished its passage through the House of Lords. Part 2 of the Bill underpins the government's plans to ensure that digital identity products and services offered in the UK can be trusted.
Why linked: Identity assurance principles for government identity services—foundational policy for GOV.UK One Login and digital ID implementation
The principles government should apply when building a service where users can prove their identity, and what GOV.UK One Login is doing to meet the principles.
Why linked: GOV.UK One Login meeting identity assurance principles—policy compliance document for national credential
GOV.UK One Login is replacing other identity assurance services that some government departments use; when government services migrate to GOV.UK One Login, this must not negatively impact accessibility.
Why linked: Understanding attributes guidance - DVS trust framework guidance for attribute service providers
A guide for organisations interested in being an 'attribute service provider' certified against the UK digital identity and attributes trust framework.
Why linked: How to score attributes guidance - DVS trust framework certification guidance
Guidance for organisations certified against the UK digital identity and attributes trust framework as an 'attribute service provider'.
Why linked: Delegated authority guidance for trust framework - DVS certification guidance
Guidance for organisations certified against the UK digital identity and attributes trust framework who offer delegated authority as part of their service.
Why linked: How to create and share attributes guidance - DVS trust framework certification guidance for attribute service providers
A guide for organisations interested in being an 'attribute service provider' certified against the UK digital identity and attributes trust framework.
Why linked: Foundational regulatory framework: gamma (0.4) trust framework, the first statutory framework under s.28 DUAA.
This is the gamma (0.4) publication of the UK digital identity and attributes trust framework; it is the first statutory trust framework under section 28 of the Data (Use and Access) Act 2025.
Why linked: Enabling the use of digital identities in the UK—Office for Digital Identities and Attributes guidance on DUAA statutory framework for digital ID
This work is led by the Office for Digital Identities and Attributes (OfDIA), part of DSIT; the Data (Use and Access) Bill includes measures to establish a statutory footing for digital verification services.
Why linked: Guidance on enabling digital identities in UK – core implementation guidance
We’re working to help people securely prove who they are without having to present physical documents.
Why linked: Accessibility statement for the DVS register — engages PSBAR 2018 cross-cutting regime.
This accessibility statement applies to the Digital Identity Register Portal, the Conformity Assessment Body Service and the register of digital identity and attribute services.
Why linked: Filled the "Digital accessibility standards and compliance guidance" gap via web research
Help your team understand why they need to meet the website and mobile app accessibility regulations.
Why linked: Filled the "Right to Work checking regime and employer guidance" gap via web research
Guidance on how digital identity providers can become certified to complete digital identity checks for the 'Right to Work', 'Right to Rent' and DBS schemes.
Why linked: 2024 guidance on mandatory use of GOV.UK One Login – operational requirement for public-facing identity services
All public facing services which require users to prove their identity and login must use GOV.UK One Login.
Why linked: Digital Government (Disclosure of Information) (Identity Verification Services) Regulations 2024 - statutory instrument for information disclosure in identity verification
These Regulations relate to the disclosure of information in relation to public service delivery, pursuant to Chapter 1 of Part 5 of the Digital Economy Act 2017 (c. 30) (“the Act”), and in particular to the creation of the digital …
Why linked: UK digital identity and attributes trust framework beta v0.3 - DVS trust framework specification document
An updated version of the digital identity and attributes trust framework, following testing and feedback.
Why linked: GOV.UK One Login additional information/consultation outcome – guidance on core identity platform
GOV.UK One Login additional information/consultation outcome – guidance on core identity platform
In response to: Draft legislation to help more people prove their identity online
Why linked: Digital right-to-work checks equality impact assessment (2022) – updated impact assessment for right-to-work implementation
Digital right-to-work checks equality impact assessment (2022) – updated impact assessment for right-to-work implementation
In response to: Digital right to work and rent checks for British and Irish citizens: equality impact ass…
Why linked: Digital right-to-work checks equality impact assessment (2021) – foundational impact assessment for mandatory digital ID deployment
Digital right-to-work checks equality impact assessment (2021) – foundational impact assessment for mandatory digital ID deployment
In response to: Digital right to work and rent checks for British and Irish citizens: equality impact ass…
Why linked: Digital right-to-work checks equality impact assessments – mandatory use case tied to digital ID credential framework
Equality impact assessments undertaken in relation to the use of digital right to work and rent checks for British and Irish citizens from 6 April 2022.
Why linked: Digital identity and attributes consultation - core policy development document directly on scope
Digital identity and attributes consultation - core policy development document directly on scope
In response to: Digital identity and attributes
Why linked: Consultation on digital identity and attributes with governing body proposals – statutory policy instrument
A consultation on digital identity and the governing body which will oversee the rules on digital identity.
Why linked: UK digital identity and attributes trust framework alpha v2 (0.2) – updated technical requirements
A revised (alpha) version of the digital identity trust framework following feedback, plus an invitation to express an interest in testing the framework.
Why linked: UK digital identity and attributes trust framework alpha v1 (0.1) – technical requirements document
Requirements for organisations wanting to provide or consume digital identity products and services.
Why linked: The previous government's consultation response on identity verification legislation provides essential background on the policy's evolution and earlier commitments against mandatory ID.
The Government remains committed to realising the benefits of individuals being able to identify themselves online in order to access public services. There are no plans to introduce mandatory digital identity.
Why linked: Code of practice on avoiding discrimination in right to work checks – contextual guidance for priority use case
Guidance for employers on how to avoid discrimination when carrying out right to work checks.
Why linked: Policy paper on Digital Identity Document Validation Technology (IDVT) for right to work and right to rent – implementation instrument
From 6 April 2022, IDVT will be introduced to support employers and landlords with right to work, right to rent and pre-employment DBS checks.
Why linked: Filled the "Right to Work checks implementation and integration timelines" gap via web research
In response to: Digital identity document validation technology (IDVT)
Why linked: MoU with Singapore on digital identity - international digital ID cooperation relevant to UK scheme design
Digital Secretary Nadine Dorries signed three MoUs with Singapore's Ministry of Communications and Information
Why linked: Right to work checks guidance for EU/EEA citizens - right-to-work checks are a priority use case for Digital ID mandatory credential implementation
Information for employers on checking EU, EEA and Swiss citizens’ right to work.
Why linked: Guidance on understanding attributes is directly relevant to the technical architecture of digital identity verification services and the DVS trust framework implementation.
Guidance on understanding attributes is directly relevant to the technical architecture of digital identity verification services and the DVS trust framework implementation.
In response to: Attributes in the UK digital identity and attributes trust framework
Why linked: Guidance on creating and sharing attributes is core technical documentation for the digital verification services framework and credential design.
Guidance on creating and sharing attributes is core technical documentation for the digital verification services framework and credential design.
In response to: Attributes in the UK digital identity and attributes trust framework
Why linked: Guidance on scoring attributes relates to the trust framework certification criteria and assessment mechanisms for DVS services.
Guidance on scoring attributes relates to the trust framework certification criteria and assessment mechanisms for DVS services.
In response to: Attributes in the UK digital identity and attributes trust framework
Why linked: Matched expansion phrase: UK Digital Identity and Attributes Trust Framework
These documents propose new requirements for organisations that want to provide digital attributes and related services.
Why linked: Digital identity call for evidence and consultation outcome, foundational government consultation on digital identity development and governance.
This call for evidence seeks views on how government can support the development and secure use of digital identities fit for the UK’s growing digital economy.
Why linked: Government response to Digital Identity Call for Evidence – policy direction setting
Government response to Digital Identity Call for Evidence – policy direction setting
In response to: Digital identity
Loading new-since list…
Loading External Lens…
The UK now has a two-layer Digital ID regime. The lower, statutory layer — Part 2 of the Data (Use and Access) Act 2025 1 — creates a trust framework, public register and 'UK CertifID' trust mark for private digital verification services, run by the Office for Digital Identities and Attributes inside DSIT; it was switched on by SI 2025/1213 on 1 December 2025 2 with the information gateway in ss.45–48 held back. The upper, executive layer is a Cabinet Office-led national Digital ID scheme, delivered through GOV.UK One Login and the GOV.UK app, formally taken on by the Cabinet Office under WMS HCWS981 on 23 October 2025 3. The national consultation 'Making public services work for you with your digital identity' (CP 1498) 4 closed on 28 April 2026 5. The next 12 months are dominated by the Government response, the first DUAA s.53 annual report, and decisions about extending right-to-work checks to the gig economy 6.
Operationally, the regime is live but not yet complete. Part 2 of the DUAA has been in force since 1 December 2025 except for the information gateway in ss.45–48 12; the gamma 0.4 trust framework remains valid in transition while the 1.0 pre-release is the policy direction of travel 34. OfDIA's published DVS register is open for applications 5 and is now supported by a published data schema 6 and a privacy notice 7. On the supplementary-code side, three sectoral codes (right-to-work, right-to-rent and DBS) sit at 0.4 8910, with right-to-work and DBS already issued in pre-release 1.0 form 1112. On the national-scheme side, GOV.UK One Login is consolidating departmental traffic: Companies House WebFiling migrated from 13 October 2025 13, the digital Veteran Card launched on 17 October 2025 14, and HMRC began onboarding new customers via One Login from 9 February 2026 15. Politically, the Cabinet Office consultation CP 1498 16 is now the centre of gravity, framed by the PM's 26 September 2025 announcement 17 and the 10 March 2026 Commons statement 18. Parliamentary scrutiny is concentrated in the Home Affairs Committee inquiry (>3,500 submissions) 19 and the SLSC's review of the DUAA commencement SIs 20.
The most material recent moves are concentrated in March–April 2026. CP 1498, the national Digital ID consultation, opened on 10 March 2026 with a Commons statement by the Chief Secretary to the Prime Minister and a parallel Lords statement on 18 March 12, and closed on 28 April 3, generating high-volume parliamentary activity — including more than two dozen written PQs on People's Panel costs, biometric provider arrangements, fallback options for people without a passport, and funding 4567. On 6 March 2026 OfDIA published the 1.0 pre-release trust framework alongside refreshed right-to-work and DBS supplementary codes 8910. On 24 March 2026 the Government published Digital Inclusion Action Plan: One Year On 1112, which is the principal accessibility backdrop to the consultation, and on 13 April 2026 the DVS data schema 1.0 was published 13. On the data-protection side, the Commencement No. 6 regulations (SI 2026/82) brought the bulk of the DUAA Part 5 data-protection reforms into force on 5 February 2026 14, and SI 2026/386 (Consequential Amendments) was debated in Grand Committee on 17 March 15. The Home Affairs Committee's November 2025 evidence session remains live behind these developments 16.
Four things matter most over the next twelve months. First, the Government response to CP 1498 — the political signal on (i) whether the national credential will become mandatory beyond right-to-work, (ii) whether non-citizens are inside or outside the scheme, and (iii) the published Data Protection Impact Assessment that PQ 125373 confirms exists but the corpus does not show as published 1. Second, commencement of DUAA ss.45–48: the information gateway and the bespoke HMRC/Welsh Revenue Authority/Revenue Scotland onward-disclosure offences remain prospective 23 and switching them on is the doctrinal hinge that converts the regime from market regulation into productive cross-government data infrastructure. Third, the DUAA s.53 statutory annual report on Part 2, the first of which is due by 1 December 2026 2; combined with the OfDIA inclusion monitoring report 4 and sectoral analysis 5 it will be the regime's first formal accountability moment. Fourth, the Home Office consultation on extending right-to-work checks to the gig economy 6: if extended, the volume of mandatory DVS interactions could increase by an order of magnitude, raising the stakes of inclusion design captured by the Digital Inclusion Action Plan 7. Subsidiary signals to track: the Home Affairs Committee report and Government response; the SLSC's treatment of the next tranche of DUAA SIs 8; ICO ADM and complaints guidance 9; and continuing security questions about One Login 1011.
Three live risks shape the regime. First, parliamentary scrutiny of trust-framework legitimacy: Lord Clement-Jones's Amendment 7 at DUAA Lords Report stage to require the trust framework to be laid before Parliament was not adopted 1, leaving the framework on a Secretary-of-State publication footing — a structural accountability gap rather than a procedural one. Second, security headroom for the One Login backbone: PQ 129967 asking whether One Login complies with the NCSC Cyber Assessment Framework was not answered before prorogation 2, and HL6781 records that the November 2023 'high level of risk' GDS assessment is still on the historic record 3. Third, mandatory-use legitimacy versus inclusion: the regime's compulsory leg is right-to-work via DUAA s.55 and IANA 2006 s.15 orders, but the equality impact assessments in the corpus pre-date the post-2025 scheme 456 — leaving an inferred-from-corpus-gap question about whether updated EIAs exist for CP 1498. Inferred from corpus gap: the DPIA for the national Digital ID scheme is referenced in PQ 125373 as completed but not visible in the corpus as published 7; the SIT Committee letter from the Minister for Migration & Citizenship of 17 March 2026 8 suggests further departmental correspondence that is not in the readable corpus.
This briefing covers BOTH the statutory DVS trust framework / register / trust mark layer under DUAA Part 2 AND the Cabinet Office national Digital ID credential delivered via GOV.UK One Login — they are integrated and should not be conflated with either one alone. Out of scope and not treated as Digital-ID material here: general DUAA Part 5 data-protection changes (covered by SI 2026/82 and the ICO DUAA guidance tracker) except as they bind DVS providers; the Online Safety Act user-verification provisions (raised in PQ 120001 but a separate regime); financial-services KYC/AML except where it uses certified DVS (Money Laundering Regulations integration is referenced); and immigration-status verification systems beyond their integration as a Digital ID use case.
Bills and Acts this regime substantively depends on. Links go to the bill's own thread on this site (where available) and to bills.parliament.uk.
Announced in the 13 May 2026 King's Speech as the bill to establish the legal framework for creating, issuing and using national Digital ID, supporting public-service access through GOV.UK channels, public-sector join-up and priority use cases including digital right-to-work checks.
Part 2 (ss.27–55) is the statutory chassis of the DVS trust framework, register, supplementary codes, information gateway and trust mark, and s.55 amends IANA 2006 s.15 to integrate DVS-registered providers into statutory right-to-work checks.
Part 5 Chapter 1 (public service delivery) is the pre-DUAA statutory base for cross-government identity verification data sharing, activated by SI 2024/64; it sits alongside, and partly behind, the new DUAA s.45 gateway.
Section 15 (penalty for employing a person subject to immigration control) is amended by DUAA s.55 so that statutory right-to-work orders can specify DVS-registered providers and their generated documents.
Section 121 data-sharing code anchors the DUAA s.49 statutory Code of Practice on disclosure of information under the s.45 DVS information gateway.
The Digital ID regime sits in two interlocking layers. The lower layer is statutory: Part 2 of the Data (Use and Access) Act 2025 creates an OfDIA-administered scheme under which any internet-delivered service that verifies a fact about an individual from third-party information ('digital verification services') can be certified against a published trust framework (s.28), recorded in a public register (s.32), allowed to display a designated trust mark (s.50) and given access to public-authority data through an information gateway (s.45). Certification runs through UKAS-accredited conformity assessment bodies; supplementary codes (s.29) add sector rules for high-stakes use cases (right-to-work, right-to-rent, DBS).
The upper layer is a Cabinet Office-led national Digital ID scheme delivered through GOV.UK One Login and the GOV.UK app. This is not a separate statutory creation; it is an executive programme that uses the existing data-sharing rails of the Digital Economy Act 2017 Part 5 (as activated by SI 2024/64) and, prospectively, the DUAA s.45 information gateway, to issue and reuse a government-anchored credential across departmental services (HMRC, Companies House, DWP, the Veteran Card, apprenticeships).
The two layers are joined by three doctrinal hinges. First, the trust framework explicitly contemplates that government-issued credentials and private DVS providers will interoperate — holder service providers can store identities created elsewhere, and orchestration service providers can check whether services they consume are on the DVS register. Second, mandatory use cases (most prominently right-to-work) are built on the supplementary-code mechanism, so legislative mandates flow into the private market via DVS certification, not via a new bespoke identity statute. Third, the information gateway in s.45–48 is the legal pipe that will eventually let HMRC, the Welsh Revenue Authority and Revenue Scotland disclose tax-status attributes to registered providers; ss.46–48 add bespoke criminal offences for onward disclosure of that information, sitting on top of the general data protection regime preserved by s.45(4).
What the regime does NOT do is itself create a compulsory national identity card or a single mandatory credential. The compulsion comes downstream, through use-case legislation (e.g. IANA 2006 s.15 right-to-work orders as amended by DUAA s.55) and through consumer-facing decisions by relying parties — not from Part 2 itself, which is essentially a market-conduct regime for private DVS firms. The current national consultation (CP 1498) is the policy vehicle for deciding which downstream mandates and integrations to attach to that statutory chassis.
An internet-delivered service, requested by an individual, that ascertains or verifies a fact about that individual from information not provided by them and confirms the fact to another person (DUAA s.27).
The Secretary of State's published rules under DUAA s.28 governing the conduct of DVS providers, currently the gamma 0.4 framework and the 1.0 pre-release.
Additional rules under DUAA s.29 that supplement the trust framework for a specific use case (digital RTW, RTR, DBS).
Public register of registered DVS providers (s.32) and designated mark (s.50) advertising compliance with the trust framework.
Prospective statutory power for any public authority to disclose information to a registered DVS provider for verification, overriding obligations of confidence subject to data protection and Investigatory Powers Act constraints.
Trust-framework concept derived from GPG 45 identity profiles, expressing how robustly an identity has been verified.
Government response to CP 1498 'Making public services work for you with your digital identity' following the 28 April 2026 close.
Final 1.0 publication of the DVS trust framework (currently pre-release) and final right-to-work, right-to-rent and DBS supplementary codes.
Commencement order(s) bringing DUAA ss.45–48 (information gateway and HMRC/WRA/Revenue Scotland onward-disclosure offences) into force.
DUAA complaints-procedure deadline for organisations to put written complaints-handling policies in place.
First annual report on the operation of DUAA Part 2 required by s.53 within 12 months of s.28 commencement (i.e. by 1 December 2026).
Outcome of the Home Office consultation on extending right-to-work checks to gig-economy work (closed 29 October 2025).
Home Affairs Committee report on 'Harnessing the potential of new forms of digital ID' and Government response.
Publication of the statutory s.49 Code of Practice on disclosure of information under DUAA s.45 (subject to draft-affirmative parliamentary procedure on first issue).
On the national Digital ID scheme: leads delivery from October 2025 onwards, frames the credential as both an illegal-working enforcement tool and a public-services efficiency reform, and is using CP 1498 to legitimise mandatory right-to-work use while keeping broader compulsion politically open.Oct 2025Oct 2025Mar 2026Mar 2026
Tension with Mr Alistair Carmichael, Lord Clement-Jones, Iqbal Mohamed, Ben Maguire
On the statutory DVS layer: champions Part 2 of the DUAA as a market-enabling regime and is rolling out the 1.0 trust framework, supplementary codes and data schema to crystallise certification standards before mandatory use cases scale.Mar 2026Apr 2026Jun 2025
On trust framework design: pursuing iterative, principles-based regulation that draws heavily on GPG 45 / GPG 44, NCSC passkey guidance and ISO 17065, and consulting widely on supplementary codes; treats the DVS register and UK CertifID trust mark as the central market-signalling devices.Mar 2026Dec 2025Apr 2026Jul 2025
On platform consolidation: actively migrating departmental identity assurance services onto GOV.UK One Login (HMRC, Companies House, Veteran Card, apprenticeships) and operationalising the GOV.UK app as the user-facing credential surface.Feb 2025Feb 2026Sep 2025Oct 2025
On right-to-work as the priority mandatory use case: consulting on extending RTW checks to gig-economy work, and underpinning the DUAA s.55 amendment to IANA 2006 s.15 that lets DVS-registered providers be specified in RTW orders.Oct 2025Jul 2025Mar 2026
On verification migration: from 9 February 2026 new HMRC customers must use GOV.UK One Login, making HMRC the highest-volume early relying party on the platform.Feb 2026
On corporate verification: moved WebFiling sign-in to GOV.UK One Login from 13 October 2025, embedding the platform in the post-ECCTA director ID verification regime.Sep 2025
On Digital ID: running an inquiry, with >3,500 public submissions, that explicitly tests proportionality, illegal-working efficacy and public trust before any mandatory expansion.Nov 2025Mar 2026
On Digital ID design: scrutinising departmental responsibility split between DSIT and the Cabinet Office and receiving direct ministerial correspondence on Digital ID after the 3 March 2026 evidence session.Mar 2026
On the DUAA commencement / consequential-amendments SIs: scrutinising the SI cascade (SI 2025/904, SI 2025/1213, SI 2026/82, SI 2026/317, SI 2026/386) that switched Part 2 on and brought the data-protection reforms into force.Mar 2026Nov 2025Feb 2026Mar 2026
On data-protection alignment: statutory consultee on the trust framework and supplementary codes; running parallel DUAA-driven consultations (ADM guidance, complaints procedure) that DVS providers must comply with.Mar 2026Jun 2025Jun 2025
On certification supply: accredits the conformity assessment bodies that can certify DVS providers against the trust framework — the gatekeeper of supply-side market entry.Jan 2026
On criminal-records use case: relying party for the DBS supplementary code, allowing certified DVS providers to support identity verification for DBS checks.Dec 2025Mar 2026
On platform security: its passkey/authentication guidance is embedded in the trust framework; PQ 129967 (unanswered before prorogation) shows live parliamentary interest in whether One Login meets the Cyber Assessment Framework.Apr 2026May 2025
Liberal Democrat critic of mandatory Digital ID; uses the Oct 2025–March 2026 Commons debate cluster to press civil-liberties and inclusion concerns against the CP 1498 proposals.Mar 2026Mar 2026
Tension with Cabinet Office, Darren Jones
Liberal Democrat peer; consistent Lords scrutiny voice arguing the DVS trust framework should be parliamentary-laid (Amendment 7 at DUAA Lords Report) and questioning the CP 1498 Digital ID design at the March 2026 statement.Jan 2025Mar 2026Jan 2026
Tension with Cabinet Office, Darren Jones
Liberal Democrat MP; consistent contributor to Oct 2025–March 2026 Digital ID debates, focused on consent and inclusive design of any mandatory credential.Mar 2026
Liberal Democrat MP; repeat speaker in 2025–26 Digital ID debates, sceptical of mandatory roll-out and pressing on rural inclusion.Mar 2026
Liberal Democrat MP; recurrent critic of Mandatory Digital ID in the October–December 2025 debate cluster.Mar 2026
Tension with Cabinet Office
Independent MP; repeat civil-liberties critic of Digital ID across Oct 2025–March 2026 debates, including the CP 1498 statement.Mar 2026
Tension with Cabinet Office
DUP MP; six recorded contributions to Digital ID debates, raising concerns about Northern Ireland, religious liberty and proportionality.Mar 2026
Conservative MP; speaks against mandatory Digital ID in the Oct 2025–March 2026 debate cluster.Mar 2026
Conservative MP; combines debate contributions and PQs to scrutinise CP 1498 cost and design questions.Mar 2026
Labour MP; engages as a technologist voice in CP 1498 and the Oct–Dec 2025 debates, focused on the One Login programme and standards.Mar 2026
Prime Minister; politically owns the national Digital ID announcement and the 23 October 2025 machinery of government transfer of the file to the Cabinet Office (live status treated as historical).Oct 2025Oct 2025
Then Secretary of State for Science, Innovation and Technology (live status unknown); answered the 18 March 2026 Commons oral questions on protection of digital identities, positioning DSIT as the technical regulator behind the Cabinet Office front.Mar 2026
As Chief Secretary to the Prime Minister, delivered the 10 March 2026 Commons statement launching CP 1498 — the most senior Cabinet Office spokesperson on the live national Digital ID consultation.Mar 2026
Tension with Mr Alistair Carmichael, Lord Clement-Jones
Private DVS provider expressly named in PQ 123830 on biometric data use; emblematic of certified private-sector providers that depend on the DVS trust framework and the s.45 information gateway for scale.Apr 2026