Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, whether a Data Protection Impact Assessment has been completed in relation to the UK Digital Identity and Attributes Trust Framework.

As DSIT is not a data controller or processor with respect to the UK digital verification services trust framework, we are not required to produce a data protection impact assessment, and have not done so. Instead, we require data controllers certified against the trust framework to complete a data protection impact assessment.

As required under the Data (Use and Access) Act 2025, we have consulted the ICO on each publication of the trust framework.