DUAA smart data schemes: how Part 1 enables telecoms and payments data portability
In short: DUAA smart data schemes operate under Part 1 of the Data (Use and Access) Act 2025. Section 2 lets the government make regulations requiring data holders to share customer data with authorised persons; section 4 does the same for business data. Sections 6, 7 and 8 add decision-makers, interface bodies and enforcement. The architecture is sector-neutral. The first sectoral statutory instrument is expected in Q4 2026 for open banking. Telecoms is a candidate sector with no SI laid. Industry-led schemes operating under a sectoral SI sit in a materially different competition law position than the same scheme operating as a private commercial arrangement.
When a customer wants their telecoms billing data shared with a comparison service, or their bank account data shared with a payments app, the law has to decide three things: who can demand the data, who must provide it, and on what technical terms. Until Part 1 of the Data (Use and Access) Act 2025 took effect, the answer differed by sector. Open banking sat under one set of rules. Telecoms switching sat under another. Energy sat under a third. The DUAA puts a single framework on the statute book that any sector can use. This piece sets out the architecture of DUAA smart data schemes, where the framework will land first in telecoms and payments, and why an industry-led scheme operating under a sectoral statutory instrument is in a materially different competition law position than the same scheme operating as a private commercial arrangement.
Key findings on DUAA smart data schemes
- Part 1 of the DUAA 2025 contains the smart data framework. Sections 1 to 26 cover customer data, business data, decision-makers, interface bodies, enforcement and restrictions on investigation. Source: DUAA 2025 Part 1.
- The framework is sector-neutral. Each sectoral application requires its own statutory instrument made under sections 2 and 4. Source: DUAA 2025 sections 2 and 4.
- The first sectoral statutory instrument is expected in Q4 2026 for open banking, giving the FCA oversight of the ecosystem. Source: Payments Forward Plan, Payments Vision Delivery Committee, 26 February 2026.
- Telecoms is a candidate sector. The government has identified it alongside energy and insurance, but no telecoms-specific smart data statutory instrument has been laid as at May 2026. Source: National Payments Vision, HM Treasury, November 2024; DSIT engagement on Part 1 implementation.
- An industry-led scheme operating under a sectoral smart data statutory instrument operates inside a regulator-administered framework. Chapter I of the Competition Act 1998 still applies, but the analysis differs from the same scheme operating as a private commercial arrangement.
Part 1 of the DUAA 2025: the architecture of smart data schemes
Part 1 of the DUAA 2025 confers powers on the Secretary of State and the Treasury to make regulations requiring data holders to share data on a structured basis. The Act does not designate any sector directly. It provides the legal machinery for DUAA smart data schemes; the substance arrives sector by sector through statutory instruments.
Section 2 is the customer data power. The government can require a data holder to provide customer data to the customer at the customer’s request, or to a person authorised by the customer (an “authorised person”, referred to in Part 1 as a “third party recipient”). Section 4 is the business data power. It does the equivalent for non-personal trading data. Sections 3 and 5 supplement those powers, setting out the procedural provisions the regulations may contain on authorisation, complaint handling, dispute resolution, charging and the use of dashboard services, electronic communications services and application programming interfaces.
Section 6 covers decision-makers. A decision-maker is the person or body the regulations appoint to authorise or approve a third party recipient. Section 7 covers interface bodies. An interface body establishes, sets standards for, or maintains the technical interface used to share data. Section 8 covers enforcement: compliance notices, financial penalties, criminal offences and powers of investigation, subject to restrictions in section 9 protecting privileged legal communications.
The architecture for DUAA smart data schemes is recognisably borrowed from the open banking framework under the CMA Retail Banking Market Investigation Order 2017 and the Payment Services Regulations 2017. Open Banking Limited operates as the interface body for the CMA9. The FCA authorises and supervises payment initiation and account information service providers. Part 1 of the DUAA takes those building blocks and puts them on a statutory footing that any sector can use, without depending on the CMA’s market investigation powers or on a sector-specific regulatory regime.
Telecoms application: where DUAA smart data schemes will fit alongside the existing regime
The telecoms sector already has data-portability arrangements, but they are narrow and sit under sector-specific Ofcom regulation rather than the DUAA. The One Touch Switching regime under Ofcom General Condition C7 lets a gaining provider initiate a switch on the customer’s behalf using a centralised hub to obtain the losing provider’s information. Number portability sits under Part 2 of the Communications Act 2003. Other telecoms data-portability arrangements include the wholesale notification of contract data under General Condition C1 and the Ofcom-mandated availability of itemised billing.
What is missing in telecoms is the structural ability for a customer to direct a third party to receive their billing, usage and contract data on a standardised basis for the third party to act on. Comparison services depend on the customer manually exporting or screen-scraping their account. Financial-services products that want to factor telecoms spending into a creditworthiness assessment depend on bilateral data-sharing arrangements with each operator. A DUAA smart data scheme for telecoms would give the customer a standardised right to direct any authorised third party to receive the data on the same terms across providers, supervised by Ofcom under a regulator-administered framework with statutory dispute resolution.
No telecoms smart data statutory instrument has been laid as at May 2026. Telecoms sits behind the open banking SI on the published schedule. When a telecoms-sector DUAA smart data scheme lands, the architecture is likely to draw on the open banking model and the One Touch Switching hub experience. The interface body concept under section 7 is a natural fit for a centralised telecoms data sharing hub. The decision-maker concept under section 6 maps onto Ofcom-led accreditation of authorised third parties. The enforcement provisions under section 8 sit alongside Ofcom’s existing General Conditions enforcement powers without displacing them.
Payments application: DUAA smart data schemes and the open banking continuation
Open banking is the existing reference model for what a DUAA smart data scheme looks like in operation. The Payment Services Regulations 2017 require account servicing payment service providers to grant access to authorised payment initiation and account information service providers at the customer’s request. The CMA Retail Banking Market Investigation Order 2017 obliges the nine largest UK personal current account providers to maintain Open Banking Limited as the interface body. The architecture exists; what changes under the DUAA is the statutory footing on which it sits.
As we set out in our companion piece on FCA open banking regulation, the 21 April 2026 HM Treasury modernisation package committed the government to giving the FCA new powers to regulate the future of Open Banking, including powers to underpin commercial open banking schemes developed by industry. The Payments Forward Plan sets the legislative vehicle: a statutory instrument under Part 1 of the DUAA 2025, expected to be laid in Parliament in Q4 2026, giving the FCA oversight of the open banking ecosystem. That SI is the first sectoral DUAA smart data scheme expected to drop, and it will set the template that other sectors follow. The DUAA does not displace the PSRs 2017 firm-level regime over payment institutions and electronic money institutions; it provides a statutory framework for the scheme-level architecture that previously sat under the CMA Order.
For industry-led schemes building on top of the open banking rails, the DUAA framework matters for a separate reason. Where a group of competitors comes together to agree the rules of a payment scheme, that arrangement engages Chapter I of the Competition Act 1998. Chapter I prohibits agreements between undertakings which have as their object or effect the prevention, restriction or distortion of competition. Industry-led schemes have historically navigated Chapter I either by relying on a section 9 individual exemption analysis (efficiency gains shared with consumers, indispensability of the restrictions, no elimination of competition) or by demonstrating that the agreement falls within a block exemption. The analysis is fact-specific and the legal risk is real. A scheme that lands on the wrong side of Chapter I exposes its participants to fines of up to 10% of worldwide turnover, automatic nullity of the offending provisions and follow-on damages claims. An industry-led scheme operating under a sectoral DUAA smart data statutory instrument is in a materially different position. The scheme rules are imposed or sanctioned by regulation made under primary legislation. The scheme operator is a body that the regulation establishes or designates. The interface body, the decision-maker and the enforcer are all statutory roles. Chapter I still applies, but the architecture of the arrangement looks fundamentally different from the standalone private commercial scheme it would otherwise be.
Comparison: DUAA smart data schemes by sector
The table below summarises where each candidate sector sits on the DUAA smart data schemes framework as at May 2026, the existing parallel regime, the expected timing of a sectoral statutory instrument, and the competition law position for an industry-led scheme in each sector.
| Sector | Existing data-portability regime | Sectoral DUAA SI status | Competition law position for industry-led schemes |
|---|---|---|---|
| Open banking (financial services) | PSRs 2017 and CMA Retail Banking Market Investigation Order 2017; Open Banking Limited as interface body | SI expected Q4 2026 per the Payments Forward Plan | Statutory framework for the FCA-supervised scheme architecture; private commercial arrangements remain subject to Chapter I analysis |
| Telecoms | Ofcom General Condition C7 (One Touch Switching); CA 2003 Part 2 (number portability) | Candidate sector; no SI laid as at May 2026 | No statutory smart data framework yet; industry-led data-sharing arrangements assessed under Chapter I on standalone basis |
| Energy | Smart meter data sharing under sector-specific regulation; Open Energy initiatives | Candidate sector; no SI laid | As above |
| Insurance | Limited data sharing under FCA conduct rules and Open Insurance industry initiatives | Candidate sector; no SI laid | As above |
| Pensions | Pensions Dashboard programme under Pensions Schemes Act 2021 | Not currently a DUAA candidate; separate statutory regime | Pensions Dashboard provider rules sit under FCA supervision |
| Mobility and transport | Limited; some industry-led initiatives | Not currently a DUAA candidate | Industry arrangements assessed under Chapter I on standalone basis |
Viewpoint
The DUAA’s horizontal architecture sits awkwardly against the UK’s sectoral regulator model. The FCA, Ofcom, Ofgem and the Pensions Regulator each occupy their own statutory territory. In practice each sector’s DUAA smart data scheme will be administered by the relevant sectoral regulator. The coordination challenge is real, and the Smart Data Council bandwidth is limited. For firms operating across pillars, the DUAA framework rationalises what would otherwise become five separate smart data regulatory relationships into one piece of primary legislation with sectoral statutory instruments underneath.
The interface body concept is the part of the DUAA smart data schemes architecture that I find most interesting. UK law has not previously put a statutory footing under the interface body. Open Banking Limited, TOTSCo (the One Touch Switching hub in telecoms), Pay.UK as the operator of Faster Payments and Bacs each exists as a private company under a regulator-led framework, but none is itself a creature of statute. The DUAA changes that. A future interface body designated by sectoral regulations will hold a statutory position. That changes the analysis of who governs the body, who can challenge its decisions, and what disputes get to the regulator. It also changes the analysis on competition law.
An industry-led scheme operating today as a private commercial arrangement is fully exposed to Chapter I. Section 9 individual exemption analysis is available but fact-specific, and the DMCCA expansion of Chapter I’s extraterritorial reach has sharpened the risk further. The same scheme operating under a sectoral DUAA smart data scheme statutory instrument is in a different place. The scheme rules are imposed or sanctioned by regulation. The interface body operates a statutory function. The decision-maker administers an authorisation process designed by Parliament. Chapter I still applies, since it is a hard prohibition with limited exemption routes, but the analysis is fundamentally different when the architecture being assessed is a regulator-administered statutory framework rather than a private agreement between competitors. The Q4 2026 open banking SI will be the first test case. The patterns it sets will be read across into telecoms, energy and the other candidate sectors. Firms building industry-led data-sharing schemes today should be planning for that statutory architecture, not against it. If you are evaluating how a DUAA smart data scheme would affect your firm, see our regulatory perimeter and market entry page.
Frequently asked questions
What is the smart data framework in Part 1 of the DUAA 2025?
Part 1 of the DUAA 2025 confers powers on the Secretary of State and the Treasury to make regulations requiring data holders to share customer data and business data. Section 2 is the customer data power; section 4 is the business data power. Sections 6, 7 and 8 add decision-makers, interface bodies and enforcement. The framework is sector-neutral. Each sectoral application requires its own statutory instrument made under the section 2 or section 4 power.
Are DUAA smart data schemes operative today?
Not yet. Part 1 of the DUAA 2025 is in force, but no sectoral statutory instrument has been laid. The first sectoral SI is expected in Q4 2026 for open banking, giving the FCA oversight of the open banking ecosystem. Until that SI is laid, the open banking arrangements continue to operate under the PSRs 2017 and the CMA Retail Banking Market Investigation Order 2017.
When will a telecoms smart data statutory instrument be laid?
The government has identified telecoms as a candidate sector for DUAA smart data schemes but the published timeline does not commit to a specific date. The Payments Forward Plan sets the open banking SI for Q4 2026; the telecoms SI sits behind that. DSIT is the lead department for the DUAA, with sectoral input from Ofcom on telecoms-specific design.
How does the DUAA framework affect Chapter I of the Competition Act 1998?
Chapter I prohibits agreements between undertakings which have as their object or effect the prevention, restriction or distortion of competition. It continues to apply to any industry-led scheme. The DUAA does not create a carve-out from Chapter I. What changes is the architecture of an industry-led scheme operating under a sectoral smart data statutory instrument. The scheme rules are imposed or sanctioned by regulation. The interface body operates a statutory function. The decision-maker administers a Parliament-designed authorisation process. The competition law analysis of such a scheme differs from the analysis of the same scheme operating as a private commercial arrangement.
What is the relationship between the DUAA and the existing open banking framework?
The PSRs 2017 regulate payment initiation service providers, account information service providers and account servicing payment service providers at the firm level. The CMA Retail Banking Market Investigation Order 2017 regulates the CMA9 at the infrastructure level. DUAA smart data schemes provide the wider statutory basis under which the scheme-level architecture (the interface body, the decision-maker, the enforcer) operates going forward. The Q4 2026 statutory instrument will move the open banking scheme architecture from the CMA Order onto the DUAA Part 1 footing. The PSRs 2017 firm-level regime continues to apply independently.
For advice on DUAA smart data schemes, payments authorisation or telecoms regulatory perimeter, contact Rob Bratby at Bratby Law. We advise telecoms operators, payment institutions, electronic money institutions, banks and scheme operators on UK regulatory architecture across the telecoms, data protection and payments pillars.
