Other Provisions in the Data (Use and Access) Act 2025: the National Asset Underground Register, Electronic Register of Births and Deaths and criminalising sexually explicit "deepfakes"

Overview

There are various "miscellaneous" provisions contained in the DUAA that do not squarely fit into the ambit of data protection but are nonetheless relevant to the safeguarding of data; personal or otherwise. In this article, we will be examining the provisions regarding the National Underground Asset Register ("NUAR"), the Electronic Register of Births and Deaths ("ERBD") and the criminalisation of creating and requesting "deepfakes" of intimate images, an offence that has been arguably shoehorned in to the DUAA to expedite urgent legal reform to address the rapid rise in the use of AI to crease alarmingly realistic, harmful images. These provisions have not yet come into force, as they require secondary legislation to be implemented.

National Underground Asset Register

The NUAR is an infrastructure initiative driven by data and aimed at enhancing the sharing of information about underground assets. It serves as a digital map of underground infrastructure and will ultimately provide one of the most comprehensive datasets of underground pipes and cables in England, Wales and Northern Ireland. The NUAR currently exists as a voluntary arrangement, with approximately 300 asset owners' information being shared through the service to date. The DUAA introduces the creation of a statutory framework for the NUAR that will be implemented through secondary legislation.

Once in effect, the NUAR will make it mandatory for underground infrastructure owners (e.g. gas providers and telecoms operators) to register asset data such as electricity cables, water pipes, high-pressure fuel pipes and other underground pipes and cables. This will provide an immediate comprehensive view of buried assets, which will be available via a secure platform, initially to asset owners and their supply chain. Failure to upload the required information about underground assets to the NUAR will constitute an offence, and the asset owner may be liable to pay compensation for non-compliance.

These changes aim to streamline information sharing and enhance the efficiency and safety of buried infrastructure management across the UK. The Government has indicated that the efficiencies introduced by the NUAR will bring over £400 million per year of economic benefits. As surface-level infrastructure such as high-rise buildings and new developments continue to shape UK cities, there is increased risk that cables and pipes could be accidentally or maliciously damaged, which the NUAR will be vital in mitigating. Organisations and construction workers should benefit from having a more comprehensive view of assets, enabling them to know exactly where any underground asset is placed. This will help construction workers quickly locate assets, speed up roadworks, and decrease traffic delays. However, this will undoubtedly place an increased burden on organisations to provide accurate data for the NUAR, and there remains a question over who exactly can access the data – this will only be clarified once secondary legislation is put into place.

Until then, asset owners and any potential users of NUAR will receive advance notice before new measures around the platform take effect. It is explicitly set out in the DUAA that the Government plans to consult with the sector about any implementation of the NUAR. Consequently, asset owners' input will no doubt be sought in due course, ensuring a collaborative approach is taken to the NUAR's development and implementation.

Electronic Register of Births and Deaths

Clause 61 of the DUAA provides for traditional paper-based registers of live births, still births and deaths to be replaced with a centralised electronic register. Registers have been paper-based in the UK since 1837, but since July 2009, information has also been recorded electronically in parallel with paper registers - arguably a duplication of effort. The DUAA formally removes the legal requirement for duplicate paper records. Outdated quarterly paper submissions would be eliminated, with data being centralised under a single, nationally maintained, digitised system. Until these provisions come into effect, every superintendent registrar must keep records of any births or deaths which are in their custody.

The impact of the ERBD has the potential to be far-reaching, even though this might not be immediately apparent. On an individual level, it creates a more convenient and less time-consuming experience, particularly during emotionally difficult times for individuals. From an administrative perspective, local authorities will not have to manage dual record systems, which will in turn increase efficiency. The ERBD should also:

• facilitate quicker access to official documents such as birth and death certificates, speeding up processes like passport applications and probate;
• make genealogical research easier; and
• reduce the likelihood of identity fraud in the long term, especially as the success of the ERBD could pave the way for digital IDs, given the UK's move to digital visas.

However, concerns about data protection and associated risks are not unfounded. Centralising sensitive personal information in a digital format increases cyber security risks, prompting the need for more robust safeguards and compliance with the GDPR and other data protection standards.

Sexually explicit deepfakes

Finally, the DUAA has addressed the urgent and growing issue of the use of AI to create realistic, sexually explicit deepfakes.

The online sharing of intimate images without consent has already been identified by the Government as a priority offence, with the Online Safety Act 2023 (the "Online Safety Act") making non-consensual intimate image abuse a criminal offence. Since deepfakes are a digitally fabricated form of such abuse, they fall within this broader category.

At the beginning of 2025, the Ministry of Justice announced a further crackdown on the rapid rise in the creation of sexually explicit deepfakes. This included the introduction of a new offence of creating, or requesting the creation of, "a purported intimate image of another person", commonly referred to as a "deepfake", without the explicit consent of the person depicted in the image. This was originally proposed for inclusion in the Government's Crime and Policing Bill but was brought forward into the DUAA to ensure the swift delivery of the Government's commitment to ban the creation of sexually explicit deepfakes. The DUAA amends the Sexual Offences Act 2003, the Armed Forces Act 2006, and the Sentencing Code. An offender under this provision of the DUAA is liable to imprisonment (either up to six months or up to 51 weeks, depending on when the offence was committed) or an unlimited fine, or both.

The DUAA provides a defence for the alleged perpetrator to prove that they had a "reasonable excuse" for creating the image, placing the legal burden of proof on the defendant. Without reference to an objective standard, the defence introduces a subjective assessment as to what constitutes a "reasonable excuse," which could prove controversial in practice. Hansard debates have acknowledged that while a "reasonable excuse" defence feels standard for new tech-related offences, it is unpredictable how courts will interpret this in practice. There is also no definition given for "creation", which will also be for the courts to determine in due course, and detection and enforcement of the offence of creating the image alone (where the image is not shared) could prove challenging.

The issue of deepfakes is a topical one and was recently addressed in Ofcom's 2024 discussion paper entitled Mitigating the Harms of Deceptive Deepfakes. This indicates that this issue is being addressed more widely through the lens of policy, and not just legislation. The Children's Commissioner has also urged the Government to ban apps that use generative AI to create sexually explicit deepfakes of children, as part of a report on “nudification” tools. As such, this DUAA provision represents a logical and urgent progression in the law.

Conclusion

The miscellaneous provisions of the DUAA reflect the Government's commitment to (i) modernise the way that data is managed; (ii) improve public services; and (ii) enhance protections for individuals. While the reforms explained above offer significant benefits for individuals, they also introduce potential compliance requirements for organisations, particularly for underground asset holders in relation to NUAR.

Stakeholders are encouraged to engage with any upcoming consultations and review internal processes to ensure readiness for the changes ahead.

The full text of the DUAA is available here.