Summary
- The consultation opened on 14 October and covers Great Britain.
- Proposals address accredited services, secure exchange and consumer protections.
- The framework is proposed, not an existing mandatory sharing regime.
The Department for Energy Security and Net Zero has opened a consultation on new rules for sharing energy-sector data with authorised services at the request of consumers. Published on 14 October 2026, the proposed smart data legislative framework would establish obligations for specified data holders alongside arrangements for accreditation, governance and consumer protection.
The consultation applies to England, Scotland and Wales. It envisages using powers under the Data (Use and Access) Act 2025 to make regulations requiring relevant organisations to make certain datasets available securely where an individual has chosen to share them. The government is seeking views on which datasets and participants should fall within scope, how the system should be funded, and how assurance would work.
Energy information already travels among suppliers, network businesses, system operators, comparison services and technology providers, but interfaces and permission structures are not necessarily consistent. A mandated framework could standardise selected exchanges while increasing the number of organisations authorised to request and process information. Both interoperability and the ability to establish legitimate access would therefore need to be designed into the rules.
Authorisation is distinct from authentication. A person may decide to share information with a service for a defined purpose, but the technical infrastructure still needs to establish which organisation is requesting it, whether the permission remains valid, and whether the data requested matches the scope of that permission. Accreditation and governance can define who participates, while security controls enforce the permitted flows.
The policy could have consequences for firms building energy-management tools, home technologies and services linked to electricity use. Consumption information can reveal behavioural patterns, while information about energy assets may have additional commercial or infrastructure sensitivity. The government is therefore consulting on safeguards alongside the economic and service benefits of accessible, interoperable data.
A mature scheme would also need routes for handling errors, revoked permissions, third-party failure and complaints. Those questions are especially relevant when information passes through several providers and the original data holder remains accountable for particular legal or contractual obligations. The consultation explicitly asks about governance and consumer protection rather than assuming that authorisation alone resolves downstream risk.
The framework is still a proposal. No company should interpret the consultation as an immediately operative legal duty to open systems to any third party claiming to have a consumer's permission. The eventual requirements, participants and timetable depend on the government's assessment of responses and any regulations subsequently made.
DESNZ has invited contributions from suppliers, networks, code bodies, digital businesses, consumer groups, academics and other stakeholders. The published consultation document sets out options for designing the legislative and technical arrangements, with feedback expected to shape the scope of future obligations.
The consultation also raises a distinction between data portability and access to live operational systems. Making an approved dataset available through a governed interface is different from giving an outside party unrestricted access to a supplier's billing platform or network management environment. The government's proposal is built around identifying specified information, qualifying participating services and setting the rules under which authorised exchanges can take place. The detail will influence both cyber resilience and market entry: smaller service providers may benefit from interoperable access, but only if accreditation and security processes are practicable. Established data holders, meanwhile, may have to accommodate new interfaces while remaining able to identify abnormal requests or revoked permissions.
The consultation also raises practical questions about attribution when data is shared through multiple authorised services. A failed request may arise from invalid permission, a supplier outage, or a malicious attempt to impersonate an approved party. The proposed framework will need clear processes for distinguishing those cases and assigning responsibility, but no final technical architecture has yet been prescribed in the consultation notice.
The October opening establishes a formal policy process for energy smart data. Until the framework is finalised, the proposed controls remain matters for consultation rather than audited measures of security or proof that existing exchanges are unsafe.
