Digital Inclusion Action Plan: One Year On
Why linked: Matched expansion phrase: Digital Inclusion Action Plan
Progress report on delivering the Digital Inclusion Action Plan.
The UK digital identity regime now has three linked layers: the statutory DVS trust framework and register under Part 2 of the Data (Use and Access) Act 2025; the Cabinet Office-led national Digital ID built on GOV.UK One Login; and the Digital Access to Services Bill announced in the 13 May 2026 King's Speech, which is intended to establish the legal framework for creating, issuing and using that national credential across public services and priority wider-economy use cases including digital right-to-work checks.
Digital ID is being positioned both as a productivity and public services reform (removing repeated identity proofing across HMRC, DWP, Companies House and the Veteran Card) and as an illegal-working enforcement tool (mandatory for right-to-work checks). It interlocks data protection, immigration enforcement, accessibility/digital inclusion and competition policy, and is now subject to live national consultation (CP 1498).
Part 2 of the DUAA is already in force for the DVS framework and register, while the national Digital ID scheme has moved from roadmap and consultation into the 2026 legislative programme. The King's Speech announced the Digital Access to Services Bill as the vehicle for national Digital ID, public-service access through the GOV.UK app, public-sector join-up and priority uses such as digital right-to-work checks.
Royal Assent 19 June 2025. Part 2 establishes the statutory DVS trust framework, register, supplementary codes, information gateway and trust mark.
10 March 2026 consultation document setting out the national Digital ID scheme for British and Irish citizens and resident foreign nationals.
Sections 27–55 confer the powers under which OfDIA maintains the trust framework, runs the DVS register and designates the UK CertifID trust mark.
Pre-DUAA data-sharing objective enabling cross-government identity verification under Part 5 of the Digital Economy Act 2017.
First revised statutory trust framework under the DUAA; renames the gamma 0.4 framework, narrows scope to natural persons and introduces the UK CertifID trust mark.
Pre-release supplementary code under DUAA s.29 setting rules for DVS providers serving employers' right-to-work checks — the priority mandatory use case.
Rules for DVS supporting Registered Bodies and Responsible Organisations conducting Disclosure and Barring Service identity checks.
Rules for DVS supporting landlords undertaking digital right to rent checks.
Commenced Part 2 of the DUAA (except ss.45–48 information gateway) on 1 December 2025, switching on the statutory DVS regime.
GDS account of how One Login implements the Identity Assurance Principles; underpins migration of departmental services to the single sign-on.
Technical schema for DVS providers and relying parties to exchange identity, attribute and confidence-level metadata consistently.
OfDIA guidance on applying to and maintaining a listing in the statutory DVS register established under DUAA s.32.
Transfers lead responsibility for Digital ID to the Cabinet Office.
Cabinet Office explainer published alongside the March 2026 consultation.
Progress report on the cross-government Digital Inclusion Action Plan — the principal accessibility backdrop against which mandatory Digital ID is being designed.
Library briefing explaining the national Digital ID consultation, the DVS regime and outstanding policy questions.
Committee evidence session noting >3,500 written submissions, the bulk from members of the public, on the national Digital ID proposals.
Costs/benefits of smart data, DVS, data protection reforms and connected measures at enactment.
Bill-stage impact assessment for Part 2 of what became the DUAA.
OfDIA findings on inclusion performance of certified services — required reading on accessibility risk.
OfDIA market and consumer-insight analysis of the UK digital identity sector.
Defines the core proposition (free government credential, mandatory for right-to-work, integrated with One Login) of the national Digital ID layer.
Right-to-work checks are the priority mandatory use case for the Digital ID credential and the DVS supplementary code.
Original policy development consultation underpinning the DVS framework legislated in DUAA Part 2.
Source of the six 'digital identity principles' explicitly referenced in the DVS trust framework 1.0.
Tracks the data-protection guidance DVS providers must operate against.
A new digital ID scheme will help combat illegal working while making it easier for the vast majority of people to use vital government services.
Why linked: Defines the dual-objective political framing under which CP 1498 and the One Login expansion are being progressed.
A new cross-government scheme, led by the Cabinet Office, will make a free and secure digital credential available to all UK citizens.
Why linked: Sets the formal cross-government 2025–2030 trajectory for the national Digital ID layer.
I am making this statement to bring to the House's attention the following Machinery of Government update.
Why linked: Reorganises lead departmental responsibility for the national Digital ID scheme — the institutional anchor of the policy.
The Digital Inclusion Action Plan aims to close the digital divide in the UK.
Why linked: Government commits to a digital inclusion programme that will be load-bearing for the legitimacy of any mandatory Digital ID.
These Regulations relate to the disclosure of information in relation to public service delivery, pursuant to Chapter 1 of Part 5 of the Digital Economy Act 2017.
Why linked: The immediate Conservative-era statutory predecessor to the DUAA s.45 information gateway, retained by the current government.
Why linked: Matched expansion phrase: Digital Inclusion Action Plan
Progress report on delivering the Digital Inclusion Action Plan.
Why linked: Digital Inclusion Action Plan: One Year On report — inclusion context for the regime.
Digital Inclusion Action Plan: One Year On report — inclusion context for the regime.
In response to: Digital Inclusion Action Plan: One Year On
Why linked: 1.0 pre-release of the renamed UK DVS trust framework (6 March 2026) — the post-statutory operational baseline.
This is the 1.0 publication of the DVS trust framework, renamed to align with the Data (Use and Access) Act 2025; it is described as a pre-release pending UKAS accreditation of conformity assessment bodies.
Why linked: The government's official Roadmap page for digital ID, setting out delivery milestones and governance arrangements.
A new cross-government scheme, led by the Cabinet Office, will make a free and secure digital credential available to all UK citizens and everyone with right to be in the UK.
Why linked: Digital Inclusion Action Plan: First Steps — published policy paper.
Digital Inclusion Action Plan: First Steps — published policy paper.
In response to: Digital Inclusion Action Plan: First Steps
Why linked: Filled the "Public service digital accessibility and inclusion guidance" gap via web research
The Digital Inclusion Action Plan aims to close the digital divide in the UK, ensuring that the benefits of technology can be felt by all.
Why linked: GOV.UK One Login meeting identity assurance principles—policy compliance document for national credential
GOV.UK One Login is replacing other identity assurance services that some government departments use; when government services migrate to GOV.UK One Login, this must not negatively impact accessibility.
Why linked: Foundational regulatory framework: gamma (0.4) trust framework, the first statutory framework under s.28 DUAA.
This is the gamma (0.4) publication of the UK digital identity and attributes trust framework; it is the first statutory trust framework under section 28 of the Data (Use and Access) Act 2025.
Why linked: Policy paper on Digital Identity Document Validation Technology (IDVT) for right to work and right to rent – implementation instrument
From 6 April 2022, IDVT will be introduced to support employers and landlords with right to work, right to rent and pre-employment DBS checks.
Why linked: Matched expansion phrase: UK Digital Identity and Attributes Trust Framework
These documents propose new requirements for organisations that want to provide digital attributes and related services.
Loading new-since list…
Loading External Lens…
The UK now has a two-layer Digital ID regime. The lower, statutory layer — Part 2 of the Data (Use and Access) Act 2025 1 — creates a trust framework, public register and 'UK CertifID' trust mark for private digital verification services, run by the Office for Digital Identities and Attributes inside DSIT; it was switched on by SI 2025/1213 on 1 December 2025 2 with the information gateway in ss.45–48 held back. The upper, executive layer is a Cabinet Office-led national Digital ID scheme, delivered through GOV.UK One Login and the GOV.UK app, formally taken on by the Cabinet Office under WMS HCWS981 on 23 October 2025 3. The national consultation 'Making public services work for you with your digital identity' (CP 1498) 4 closed on 28 April 2026 5. The next 12 months are dominated by the Government response, the first DUAA s.53 annual report, and decisions about extending right-to-work checks to the gig economy 6.
Operationally, the regime is live but not yet complete. Part 2 of the DUAA has been in force since 1 December 2025 except for the information gateway in ss.45–48 12; the gamma 0.4 trust framework remains valid in transition while the 1.0 pre-release is the policy direction of travel 34. OfDIA's published DVS register is open for applications 5 and is now supported by a published data schema 6 and a privacy notice 7. On the supplementary-code side, three sectoral codes (right-to-work, right-to-rent and DBS) sit at 0.4 8910, with right-to-work and DBS already issued in pre-release 1.0 form 1112. On the national-scheme side, GOV.UK One Login is consolidating departmental traffic: Companies House WebFiling migrated from 13 October 2025 13, the digital Veteran Card launched on 17 October 2025 14, and HMRC began onboarding new customers via One Login from 9 February 2026 15. Politically, the Cabinet Office consultation CP 1498 16 is now the centre of gravity, framed by the PM's 26 September 2025 announcement 17 and the 10 March 2026 Commons statement 18. Parliamentary scrutiny is concentrated in the Home Affairs Committee inquiry (>3,500 submissions) 19 and the SLSC's review of the DUAA commencement SIs 20.
The most material recent moves are concentrated in March–April 2026. CP 1498, the national Digital ID consultation, opened on 10 March 2026 with a Commons statement by the Chief Secretary to the Prime Minister and a parallel Lords statement on 18 March 12, and closed on 28 April 3, generating high-volume parliamentary activity — including more than two dozen written PQs on People's Panel costs, biometric provider arrangements, fallback options for people without a passport, and funding 4567. On 6 March 2026 OfDIA published the 1.0 pre-release trust framework alongside refreshed right-to-work and DBS supplementary codes 8910. On 24 March 2026 the Government published Digital Inclusion Action Plan: One Year On 1112, which is the principal accessibility backdrop to the consultation, and on 13 April 2026 the DVS data schema 1.0 was published 13. On the data-protection side, the Commencement No. 6 regulations (SI 2026/82) brought the bulk of the DUAA Part 5 data-protection reforms into force on 5 February 2026 14, and SI 2026/386 (Consequential Amendments) was debated in Grand Committee on 17 March 15. The Home Affairs Committee's November 2025 evidence session remains live behind these developments 16.
Four things matter most over the next twelve months. First, the Government response to CP 1498 — the political signal on (i) whether the national credential will become mandatory beyond right-to-work, (ii) whether non-citizens are inside or outside the scheme, and (iii) the published Data Protection Impact Assessment that PQ 125373 confirms exists but the corpus does not show as published 1. Second, commencement of DUAA ss.45–48: the information gateway and the bespoke HMRC/Welsh Revenue Authority/Revenue Scotland onward-disclosure offences remain prospective 23 and switching them on is the doctrinal hinge that converts the regime from market regulation into productive cross-government data infrastructure. Third, the DUAA s.53 statutory annual report on Part 2, the first of which is due by 1 December 2026 2; combined with the OfDIA inclusion monitoring report 4 and sectoral analysis 5 it will be the regime's first formal accountability moment. Fourth, the Home Office consultation on extending right-to-work checks to the gig economy 6: if extended, the volume of mandatory DVS interactions could increase by an order of magnitude, raising the stakes of inclusion design captured by the Digital Inclusion Action Plan 7. Subsidiary signals to track: the Home Affairs Committee report and Government response; the SLSC's treatment of the next tranche of DUAA SIs 8; ICO ADM and complaints guidance 9; and continuing security questions about One Login 1011.
Three live risks shape the regime. First, parliamentary scrutiny of trust-framework legitimacy: Lord Clement-Jones's Amendment 7 at DUAA Lords Report stage to require the trust framework to be laid before Parliament was not adopted 1, leaving the framework on a Secretary-of-State publication footing — a structural accountability gap rather than a procedural one. Second, security headroom for the One Login backbone: PQ 129967 asking whether One Login complies with the NCSC Cyber Assessment Framework was not answered before prorogation 2, and HL6781 records that the November 2023 'high level of risk' GDS assessment is still on the historic record 3. Third, mandatory-use legitimacy versus inclusion: the regime's compulsory leg is right-to-work via DUAA s.55 and IANA 2006 s.15 orders, but the equality impact assessments in the corpus pre-date the post-2025 scheme 456 — leaving an inferred-from-corpus-gap question about whether updated EIAs exist for CP 1498. Inferred from corpus gap: the DPIA for the national Digital ID scheme is referenced in PQ 125373 as completed but not visible in the corpus as published 7; the SIT Committee letter from the Minister for Migration & Citizenship of 17 March 2026 8 suggests further departmental correspondence that is not in the readable corpus.
This briefing covers BOTH the statutory DVS trust framework / register / trust mark layer under DUAA Part 2 AND the Cabinet Office national Digital ID credential delivered via GOV.UK One Login — they are integrated and should not be conflated with either one alone. Out of scope and not treated as Digital-ID material here: general DUAA Part 5 data-protection changes (covered by SI 2026/82 and the ICO DUAA guidance tracker) except as they bind DVS providers; the Online Safety Act user-verification provisions (raised in PQ 120001 but a separate regime); financial-services KYC/AML except where it uses certified DVS (Money Laundering Regulations integration is referenced); and immigration-status verification systems beyond their integration as a Digital ID use case.
Bills and Acts this regime substantively depends on. Links go to the bill's own thread on this site (where available) and to bills.parliament.uk.
Announced in the 13 May 2026 King's Speech as the bill to establish the legal framework for creating, issuing and using national Digital ID, supporting public-service access through GOV.UK channels, public-sector join-up and priority use cases including digital right-to-work checks.
Part 2 (ss.27–55) is the statutory chassis of the DVS trust framework, register, supplementary codes, information gateway and trust mark, and s.55 amends IANA 2006 s.15 to integrate DVS-registered providers into statutory right-to-work checks.
Part 5 Chapter 1 (public service delivery) is the pre-DUAA statutory base for cross-government identity verification data sharing, activated by SI 2024/64; it sits alongside, and partly behind, the new DUAA s.45 gateway.
Section 15 (penalty for employing a person subject to immigration control) is amended by DUAA s.55 so that statutory right-to-work orders can specify DVS-registered providers and their generated documents.
Section 121 data-sharing code anchors the DUAA s.49 statutory Code of Practice on disclosure of information under the s.45 DVS information gateway.
The Digital ID regime sits in two interlocking layers. The lower layer is statutory: Part 2 of the Data (Use and Access) Act 2025 creates an OfDIA-administered scheme under which any internet-delivered service that verifies a fact about an individual from third-party information ('digital verification services') can be certified against a published trust framework (s.28), recorded in a public register (s.32), allowed to display a designated trust mark (s.50) and given access to public-authority data through an information gateway (s.45). Certification runs through UKAS-accredited conformity assessment bodies; supplementary codes (s.29) add sector rules for high-stakes use cases (right-to-work, right-to-rent, DBS).
The upper layer is a Cabinet Office-led national Digital ID scheme delivered through GOV.UK One Login and the GOV.UK app. This is not a separate statutory creation; it is an executive programme that uses the existing data-sharing rails of the Digital Economy Act 2017 Part 5 (as activated by SI 2024/64) and, prospectively, the DUAA s.45 information gateway, to issue and reuse a government-anchored credential across departmental services (HMRC, Companies House, DWP, the Veteran Card, apprenticeships).
The two layers are joined by three doctrinal hinges. First, the trust framework explicitly contemplates that government-issued credentials and private DVS providers will interoperate — holder service providers can store identities created elsewhere, and orchestration service providers can check whether services they consume are on the DVS register. Second, mandatory use cases (most prominently right-to-work) are built on the supplementary-code mechanism, so legislative mandates flow into the private market via DVS certification, not via a new bespoke identity statute. Third, the information gateway in s.45–48 is the legal pipe that will eventually let HMRC, the Welsh Revenue Authority and Revenue Scotland disclose tax-status attributes to registered providers; ss.46–48 add bespoke criminal offences for onward disclosure of that information, sitting on top of the general data protection regime preserved by s.45(4).
What the regime does NOT do is itself create a compulsory national identity card or a single mandatory credential. The compulsion comes downstream, through use-case legislation (e.g. IANA 2006 s.15 right-to-work orders as amended by DUAA s.55) and through consumer-facing decisions by relying parties — not from Part 2 itself, which is essentially a market-conduct regime for private DVS firms. The current national consultation (CP 1498) is the policy vehicle for deciding which downstream mandates and integrations to attach to that statutory chassis.
An internet-delivered service, requested by an individual, that ascertains or verifies a fact about that individual from information not provided by them and confirms the fact to another person (DUAA s.27).
The Secretary of State's published rules under DUAA s.28 governing the conduct of DVS providers, currently the gamma 0.4 framework and the 1.0 pre-release.
Additional rules under DUAA s.29 that supplement the trust framework for a specific use case (digital RTW, RTR, DBS).
Public register of registered DVS providers (s.32) and designated mark (s.50) advertising compliance with the trust framework.
Prospective statutory power for any public authority to disclose information to a registered DVS provider for verification, overriding obligations of confidence subject to data protection and Investigatory Powers Act constraints.
Trust-framework concept derived from GPG 45 identity profiles, expressing how robustly an identity has been verified.
Government response to CP 1498 'Making public services work for you with your digital identity' following the 28 April 2026 close.
Final 1.0 publication of the DVS trust framework (currently pre-release) and final right-to-work, right-to-rent and DBS supplementary codes.
Commencement order(s) bringing DUAA ss.45–48 (information gateway and HMRC/WRA/Revenue Scotland onward-disclosure offences) into force.
DUAA complaints-procedure deadline for organisations to put written complaints-handling policies in place.
First annual report on the operation of DUAA Part 2 required by s.53 within 12 months of s.28 commencement (i.e. by 1 December 2026).
Outcome of the Home Office consultation on extending right-to-work checks to gig-economy work (closed 29 October 2025).
Home Affairs Committee report on 'Harnessing the potential of new forms of digital ID' and Government response.
Publication of the statutory s.49 Code of Practice on disclosure of information under DUAA s.45 (subject to draft-affirmative parliamentary procedure on first issue).
On the national Digital ID scheme: leads delivery from October 2025 onwards, frames the credential as both an illegal-working enforcement tool and a public-services efficiency reform, and is using CP 1498 to legitimise mandatory right-to-work use while keeping broader compulsion politically open.Oct 2025Oct 2025Mar 2026Mar 2026
Tension with Mr Alistair Carmichael, Lord Clement-Jones, Iqbal Mohamed, Ben Maguire
On the statutory DVS layer: champions Part 2 of the DUAA as a market-enabling regime and is rolling out the 1.0 trust framework, supplementary codes and data schema to crystallise certification standards before mandatory use cases scale.Mar 2026Apr 2026Jun 2025
On trust framework design: pursuing iterative, principles-based regulation that draws heavily on GPG 45 / GPG 44, NCSC passkey guidance and ISO 17065, and consulting widely on supplementary codes; treats the DVS register and UK CertifID trust mark as the central market-signalling devices.Mar 2026Dec 2025Apr 2026Jul 2025
On platform consolidation: actively migrating departmental identity assurance services onto GOV.UK One Login (HMRC, Companies House, Veteran Card, apprenticeships) and operationalising the GOV.UK app as the user-facing credential surface.Feb 2025Feb 2026Sep 2025Oct 2025
On right-to-work as the priority mandatory use case: consulting on extending RTW checks to gig-economy work, and underpinning the DUAA s.55 amendment to IANA 2006 s.15 that lets DVS-registered providers be specified in RTW orders.Oct 2025Jul 2025Mar 2026
On verification migration: from 9 February 2026 new HMRC customers must use GOV.UK One Login, making HMRC the highest-volume early relying party on the platform.Feb 2026
On corporate verification: moved WebFiling sign-in to GOV.UK One Login from 13 October 2025, embedding the platform in the post-ECCTA director ID verification regime.Sep 2025
On Digital ID: running an inquiry, with >3,500 public submissions, that explicitly tests proportionality, illegal-working efficacy and public trust before any mandatory expansion.Nov 2025Mar 2026
On Digital ID design: scrutinising departmental responsibility split between DSIT and the Cabinet Office and receiving direct ministerial correspondence on Digital ID after the 3 March 2026 evidence session.Mar 2026
On the DUAA commencement / consequential-amendments SIs: scrutinising the SI cascade (SI 2025/904, SI 2025/1213, SI 2026/82, SI 2026/317, SI 2026/386) that switched Part 2 on and brought the data-protection reforms into force.Mar 2026Nov 2025Feb 2026Mar 2026
On data-protection alignment: statutory consultee on the trust framework and supplementary codes; running parallel DUAA-driven consultations (ADM guidance, complaints procedure) that DVS providers must comply with.Mar 2026Jun 2025Jun 2025
On certification supply: accredits the conformity assessment bodies that can certify DVS providers against the trust framework — the gatekeeper of supply-side market entry.Jan 2026
On criminal-records use case: relying party for the DBS supplementary code, allowing certified DVS providers to support identity verification for DBS checks.Dec 2025Mar 2026
On platform security: its passkey/authentication guidance is embedded in the trust framework; PQ 129967 (unanswered before prorogation) shows live parliamentary interest in whether One Login meets the Cyber Assessment Framework.Apr 2026May 2025
Liberal Democrat critic of mandatory Digital ID; uses the Oct 2025–March 2026 Commons debate cluster to press civil-liberties and inclusion concerns against the CP 1498 proposals.Mar 2026Mar 2026
Tension with Cabinet Office, Darren Jones
Liberal Democrat peer; consistent Lords scrutiny voice arguing the DVS trust framework should be parliamentary-laid (Amendment 7 at DUAA Lords Report) and questioning the CP 1498 Digital ID design at the March 2026 statement.Jan 2025Mar 2026Jan 2026
Tension with Cabinet Office, Darren Jones
Liberal Democrat MP; consistent contributor to Oct 2025–March 2026 Digital ID debates, focused on consent and inclusive design of any mandatory credential.Mar 2026
Liberal Democrat MP; repeat speaker in 2025–26 Digital ID debates, sceptical of mandatory roll-out and pressing on rural inclusion.Mar 2026
Liberal Democrat MP; recurrent critic of Mandatory Digital ID in the October–December 2025 debate cluster.Mar 2026
Tension with Cabinet Office
Independent MP; repeat civil-liberties critic of Digital ID across Oct 2025–March 2026 debates, including the CP 1498 statement.Mar 2026
Tension with Cabinet Office
DUP MP; six recorded contributions to Digital ID debates, raising concerns about Northern Ireland, religious liberty and proportionality.Mar 2026
Conservative MP; speaks against mandatory Digital ID in the Oct 2025–March 2026 debate cluster.Mar 2026
Conservative MP; combines debate contributions and PQs to scrutinise CP 1498 cost and design questions.Mar 2026
Labour MP; engages as a technologist voice in CP 1498 and the Oct–Dec 2025 debates, focused on the One Login programme and standards.Mar 2026
Prime Minister; politically owns the national Digital ID announcement and the 23 October 2025 machinery of government transfer of the file to the Cabinet Office (live status treated as historical).Oct 2025Oct 2025
Then Secretary of State for Science, Innovation and Technology (live status unknown); answered the 18 March 2026 Commons oral questions on protection of digital identities, positioning DSIT as the technical regulator behind the Cabinet Office front.Mar 2026
As Chief Secretary to the Prime Minister, delivered the 10 March 2026 Commons statement launching CP 1498 — the most senior Cabinet Office spokesperson on the live national Digital ID consultation.Mar 2026
Tension with Mr Alistair Carmichael, Lord Clement-Jones
Private DVS provider expressly named in PQ 123830 on biometric data use; emblematic of certified private-sector providers that depend on the DVS trust framework and the s.45 information gateway for scale.Apr 2026