Info Gov

The Government has published detailed proposals for a statutory Digital ID framework that would establish a legally recognised identity credential for use across public services and, in time, regulated private sector transactions.

The Digital ID would be free and available initially from age 16, though the consultation seeks views on lowering eligibility to 13 or introducing credentials from birth. While the use of Digital ID is planned to be voluntary for individuals, the plans anticipate statutory changes to make digital right to work checks mandatory, replacing manual document checks. The Digital ID, the consultation says, is also intended to streamline interactions across public services, reducing duplicated identity verification, enabling “proactive” service delivery models, and improving data quality.

The plans, outlined in a newly released consultation summary, set out the legal, technical and governance architecture required to deliver a secure, inclusive and decentralised system.

Under the proposals, ministers will introduce primary legislation to define the Digital ID, create statutory processes for issuing, updating and revoking credentials, and establish rules governing verification, data sharing and retention. The framework will be underpinned by UK GDPR, the Data Protection Act 2018, and privacy by design requirements, with no expansion of police or intelligence access powers beyond existing statutory gateways.

Ministers intend to bring forward a legislative package that will:
• Define the Digital ID credential and its legal status.
• Establish statutory rules for issuing, updating and revoking an ID.
• Provide a legal basis for authentication checks through a new Government Checker service.
• Enshrine privacy by design duties, data minimisation, and compliance with UK GDPR and the Data Protection Act 2018.
• Clarify that no new police or intelligence powers to demand an ID will be created; access will remain subject to existing statutory gateways.

The Government also proposes “transparent redress mechanisms”, drawing parallels with the HM Passport Office’s four stage complaints process, and says it is considering independent oversight bodies to reinforce parliamentary scrutiny and public trust.

Technically, the system will rely on decentralised storage, with users holding their credentials in the GOV.UK Wallet or certified third party digital wallets. Identity proofing will be carried out through GOV.UK One Login or authoritative sources such as HM Passport Office and UK Visas and Immigration.

Credentials will incorporate cryptographic protections, selective disclosure capabilities and interoperability standards aligned with the UK Digital Identity and Attributes Trust Framework.

Verification will be delivered through certified Digital Verification Service (DVS) providers, supported by a new Government Checker service capable of confirming validity, revocation status and authenticity with user consent. A low cost or free version may be made available for low volume users. All checks will require user consent and involve only “minimal necessary” data sharing.

The consultation emphasises the benefits of the scheme as being enhanced cyber security, fraud prevention and protected routes for vulnerable users. Mandatory digital right to work checks are envisaged, alongside wider public service integration. The Government claims potential long term savings of £10bn annually across the public sector and £1.8bn for households, though full impact assessments are ongoing.

Legislation is expected to follow further stakeholder engagement, with all government services due to be onboarded to GOV.UK One Login by 2027.

The government said that it would particularly welcome input from a wide range of stakeholders, from businesses to trade unions, technologists and civil society, as well as leaders in the public and private sectors who can use the digital ID to improve services for people in the UK.
The consultation is open until 5th May 2026 and can be accessed here: https://assets.publishing.service.gov.uk/media/69afe396c78869bf8eb8a5ab/Making_public_services_work_for_you_with_your_digital_identity.pdf

Also in this section

Sep 11, 2026

Anthropic discloses fourth incident of AI model attacking real systems and hands investigation to independent evaluation organisation

Anthropic has published details of four incidents in which its Claude models gained unauthorised access to real third-party systems during cybersecurity evaluations, downloading and modifying user records at a real company, reading the personal information of an individual, harvesting credentials and accessing a security vendor's live database, after the test environments were mistakenly…
Sep 10, 2026

Welsh environmental watchdog hit by data breach

Environmental regulator Natural Resources Wales (NRW) has reported itself to the Information Commissioner's Office after a data breach saw personal details of staff made public.
Aug 24, 2026

Ministers seek power to ban tech risky vendors from critical sectors and bar recipients from discussing the order

The government has tabled amendments to the Cyber Security and Resilience (Network and Information Systems) Bill that would allow the Secretary of State to direct operators of essential services, data centres, managed service providers and other designated organisations to stop buying from, restrict the use of, or remove and disable products from a named vendor on national security grounds, with…
Aug 12, 2026

ACRO Criminal Records Office reprimanded by ICO following cyber security failings

The Information Commissioner's Office (ICO) has urged organisations to strengthen “patching and security monitoring processes” after cyber security failings at ACRO Criminal Records Office left the personal information of up to ten-thousand people, including some individuals’ sensitive data, potentially exposed.
Aug 06, 2026

AI agents sent malicious files to real developers and planted prompt injections in unmonitored test: AISI

The AI Security Institute (AISI) has published an incident report disclosing that AI agents under evaluation in its research environment took sustained, unsanctioned action against real people and organisations on the live internet, including researching the human maintainers of an open-source project, creating fake online identities to pressure one of them into approving malicious code, and…
Aug 05, 2026

Third AI platform goes rogue during cyber testing

The AI Security Institute (AISI) has reveaked a security incident in which AI agents being evaluated for their cyber capabilities took sustained, unsanctioned action directed at real people and organisations, including an attempted supply-chain attack on a publicly used open-source software project.

InfoGov Masthead Newsletter 800