The United Kingdom crossed a significant threshold in digital identity policy this week when Parliament received a draft code of practice that, once approved, will allow private-sector verification firms to query government databases — including records containing biometric data — in real time on behalf of individuals requesting identity checks. The code, prepared jointly by the Department for Digital, Culture, Media and Sport (DCMS) and the Office for Digital Identities and Attributes (OfDIA), was laid before Parliament and published on October 21 under Section 49 of the Data (Use and Access) Act 2025.

That biometric data is on the table matters for a reason the code does not pause to address: unlike a password or an access token, a facial image or fingerprint record cannot be canceled and reissued. Once government-held biometric data flows through a private-sector identity provider and that provider suffers a breach, the individuals whose records were compromised have no recourse to change their biometrics. The information gateway the code enables is not just another data-sharing mechanism — it is the first UK legal framework permitting private firms to receive, in real time, the class of personal data whose theft causes permanent harm.

Before the power can go live, Parliament must pass a resolution in each House approving the draft. Officials are targeting approval and commencement before the end of 2026.

What the Information Gateway Actually Does

The information gateway power sits in Section 45 of Data Act 2025. It gives public authorities the power to disclose information to a registered Digital Verification Service (DVS) provider when the provider requests it on behalf of a user who wants a digital identity check. The draft code, required by Section 49 before the gateway can commence, sets out the guidance public authorities must follow when exercising that power.

The gateway operates through an application programming interface, or via verifiable credentials — cryptographically signed digital assertions that allow a data point to be confirmed without transmitting the full underlying record, as OfDIA’s October 21 guidance explains. A practical example in the draft describes a simple yes-or-no check against a date of birth to confirm a person is above a minimum age, rather than disclosing the full date itself. That data-minimization logic runs throughout the code: public authorities are told to share only what a given verification service actually needs for the specific transaction, and to consider whether a provider truly needs an entire credential rather than a narrower attribute check.

On the obligation to respond, the code takes a notably firm line: a public authority should not refuse to share information unless it has a reasonable justification grounded in public-law principles. Cost and resource constraints are explicitly listed as insufficient grounds for refusal.

Biometric Data Gets Special Treatment — But Still Flows Through

UK GDPR biometric data prohibition classifies facial images and fingerprint records processed for the purpose of uniquely identifying a natural person as special category personal data, requiring a two-layer legal test before they can be shared. The draft code spells out that test: an authority must have both a lawful basis under Article 6(1) of the UK GDPR and must separately satisfy one of the conditions under Article 9 and, where relevant, Data Protection Act Schedule 1.

In plain terms, sharing a facial image from a passport or a fingerprint record with a DVS provider requires more than a general permission to share data. The authority must identify both why it is lawful to share and why the specific special-category processing is justified. The code does not create new permissions — it tells authorities how to navigate permissions that already exist. What it does create, for the first time in UK law, is a legal pathway for that navigation to happen in real time, at scale, through a private-sector intermediary.

The permanent irreversibility of biometric data makes that distinction meaningful. The ICO annual report 2025-26 shows the Information Commissioner’s Office broadly supported the DVS trust framework while calling for “appropriate safeguards” and saying any system using personal data must “earn public trust and confidence.” Big Brother Watch director warned that accumulating facial recognition and biometric data in identity infrastructure creates “a honeypot for hackers,” and called the broader GOV.UK Wallet scheme “mandatory ID in all but name.” Where a breach of a password-based system can be remedied by resetting credentials, a breach of a system holding biometric records cannot.

Who Will Use the Gateway: 48 Certified Providers, 65 Services

The DVS ecosystem the gateway is designed to serve has been building out steadily while waiting for the code to arrive. Version 1.0 of the DVS Trust Framework was published in June 2026 and took effect on September 2, 2026, when the United Kingdom Accreditation Service accredited the first conformity assessment body able to certify providers. The public DVS services register lists 65 services from 48 certified providers as of October 2026. Those providers carry the UK CertifID trust mark, issued by OfDIA, which signals to relying parties that a service has been independently audited against the government’s rules.

The OfDIA sectoral analysis 2026, published in July 2026, identified 275 firms offering digital identity products and services in the UK, with annual revenue of £2.027 billion (approximately $2.716 billion) and a gross value added of £1.037 billion (approximately $1.388 billion). The analysis found a 77% adoption rate across relevant sectors — an industry that has been waiting for government data to become technically accessible through the gateway infrastructure it has spent a year building toward.

GOV.UK Wallet — the government’s mobile credential wallet built on the GOV.UK One Login platform — published GOV.UK Wallet sandbox guidance in September 2026, letting certified DVS providers begin technical integration testing ahead of production launch. A fresh call for digital verification providers to begin onboarding was published the same day the information gateway code was laid in Parliament.

One initial carve-out applies: HMRC, Revenue Scotland, and the Welsh Revenue Authority are excluded from the first phase of commencement. OfDIA says it is continuing to work toward commencing the gateway for those three authorities and will set out a timeline in due course.

What Does the Code Require of Public Authorities?

Beyond the “cannot refuse on cost grounds” provision, the code recommends that a data sharing agreement between the authority and the DVS provider be in place before information changes hands — a formality that creates a contractual chain of responsibility for the data as it moves from government to private sector. The code specifies that data may be released through an API, as a verifiable credential, or by other agreed means, preserving flexibility in the technical implementation while ensuring the exchange is documented.

The data minimization requirement is stated repeatedly in the code’s logic: the gateway is not a mechanism for DVS providers to obtain full identity records. It is a mechanism for confirming specific facts — age, identity, status — with the minimum data necessary for the transaction. Whether that principle holds in practice, as use cases multiply and commercial pressures push providers toward richer data sets, remains one of the central questions the framework’s governance will need to manage.

Oversight in Flux: DSIT Built It, DCMS Now Owns It

The code’s publication lands at an unusual moment for digital identity policy in Whitehall. In July 2026, Prime Minister Andy Burnham’s government dissolved the Department for Science, Innovation and Technology — DSIT — as Sifted then reported — a three-year-old department whose lifespan encompassed most of the legislative groundwork for the Data Act and the DVS framework. Digital identity policy moved, alongside a wider digital brief, to a reinstated DCMS, as Advanced Television reported. Secretary of State Lisa Nandy now leads the enlarged department — a role that encompasses digital identity, online safety, digital inclusion, cyber resilience, and telecoms, with no documented prior digital policy positions on the record.

Speaking before the House of Commons Public Accounts Committee, DCMS Permanent Secretary Susannah Storey framed the reorganization as “digital mainstreaming” — a shift that, in her telling, will embed digital policy more directly alongside business and innovation rather than keeping it in a technology-specific silo. Committee members were also asking Storey, at a basic level, to explain the distinction between digital identity and the GOV.UK One Login program — questions that suggest DCMS is still orienting to a domain it has just inherited.

Critics of the transition have been direct. Sarah Munby, the former Permanent Secretary of DSIT, warned of fragmentation risks — separating data, digital, and AI functions could fragment capabilities that had “only recently begun to work as an integrated whole.” “Confusion and uncertainty are the enemy,” she said, acknowledging the “knotty coordination” now required across the Cabinet Office, the new Department for Business, Innovation, Science and Technology, and DCMS. Lord Tarassenko, speaking in the Lords, said the transition would take around a year — “an eternity in AI,” in his words.

That the country’s most senior official in the department overseeing the information gateway is engaged in basic educational exchanges about what that gateway is, even as the first major piece of gateway infrastructure reaches Parliament, illustrates the distance that still separates the technical machinery of the UK’s digital identity framework from the accountability structures that are supposed to govern it.

What Happens Next — and What’s Still Excluded

The draft code must clear both Houses of Parliament before it becomes effective. OfDIA has said it aims to complete that process before the end of 2026 and intends to commence Section 45 at the same moment the final code is published — meaning the information gateway and the code of practice will effectively go live simultaneously.

In parallel, DCMS and OfDIA plan to publish non-statutory guidance and templates for public authorities and DVS providers to support practical implementation, also expected before year end. That material will be critical for authorities that have not yet built the legal basis analysis and data sharing agreements the code requires.

The UK is not the first country to create a statutory framework for private-sector access to government identity records. Comparable regimes operate across Scandinavia and are advancing in the European Union under the eIDAS 2.0 EU identity regulation. But the particular combination of a trust framework, a public register, a government wallet, and now a statutory data-sharing code puts the UK’s architecture among the more legally articulated frameworks globally — and, consequently, among the more consequential to get right. Once Parliament votes and Section 45 commences, the information gateway will be live. The 48 providers and 275 firms waiting for it will connect. And the question of what happens when the first DVS provider suffers a breach — and whether individuals whose irreplaceable biometric records were in that pipeline have any meaningful remedy — will become a question with real answers rather than a theoretical one.

Currency conversions in this article are based on an exchange rate of 1 GBP = $1.3393 USD as of October 22, 2026, and are approximate.

Frequently Asked Questions

What is the UK information gateway and who controls it?

The information gateway is a power created by Section 45 of the Data (Use and Access) Act 2025 that allows public authorities to share personal data — including biometric data such as facial images from passport records — with registered Digital Verification Service providers in real time, when an individual requests an identity check. The gateway is overseen by the Office for Digital Identities and Attributes (OfDIA), which operates within the Department for Digital, Culture, Media and Sport (DCMS). The gateway is not yet live; Parliament must pass resolutions in both Houses approving the draft code before Section 45 can commence. Officials are targeting commencement before the end of 2026.

Can UK government biometric data be shared with private companies, and what are the privacy risks?

Yes, once Parliament approves the code, government-held biometric data — including facial images and fingerprint records — can be shared with certified DVS providers on an individual’s request, subject to a two-layer legal test under UK GDPR Article 9 biometric rules. The specific risk that distinguishes biometric data from other personal data is irreversibility: if a password or account credential is stolen, it can be changed. If biometric data is stolen from a DVS provider or the data pipeline connecting it to government databases, the affected individuals cannot change their face, fingerprints, or other biometric identifiers. UK GDPR imposes stricter requirements on biometric processing than on ordinary personal data, but legal protections and permanent exposure to a breach are not equivalent protections.

What is a Digital Verification Service provider and how are they certified?

A Digital Verification Service provider is a private-sector company certified under the UK DVS Trust Framework to perform identity checks on behalf of individuals. Certification requires passing an independent audit against the trust framework’s standards, conducted by a conformity assessment body accredited by the United Kingdom Accreditation Service (UKAS). Certified providers receive the UK CertifID trust mark from OfDIA and are listed on the public DVS register. As of October 2026, 65 services from 48 certified providers are on the register. Certification is required before a provider can access the information gateway once it commences. Full certification requirements are set out in DVS trust framework version 1.0.

What happens to my data once a DVS provider uses the gateway on my behalf?

The draft code requires DVS providers to enter data sharing agreements with public authorities before accessing the gateway, and it imposes data minimization requirements — providers should receive only the specific attribute or confirmation they need for the transaction, not full identity records. However, once data is transmitted to a DVS provider, it is subject to that provider’s own data handling practices, UK GDPR obligations, and any contractual restrictions in the data sharing agreement. The code does not establish a universal data deletion schedule or a mechanism for individuals to verify what was shared. The Information Commissioner’s Office (transitioning to the Information Commission from September 30, 2026) retains enforcement jurisdiction over DVS providers’ data protection compliance.