Summary

  • Ofgem sent P494 back because a GDPR processing basis does not by itself give Elexon authority to establish and run a Smart Data Repository.
  • The next draft needs a licence basis, detailed operating rules, an operations manual and a complete assurance package before Ofgem can decide.

Ofgem’s Smart Data Repository has a neat promise: a meter’s short memory need not be the system’s memory. Smart meters retain half-hourly electricity readings for 13 months; after that, the data are no longer accessible from the meter. Elexon wants a separate store that could keep relevant readings longer and make them available for system planning, research, tariff comparison and consumer-led flexibility. The store is still a proposal, not an operating service.

The important line in Ofgem’s September papers is not about storage capacity. It is about who has authority to create the store. Elexon advanced the repository through Balancing and Settlement Code modification P494. The BSC Panel recommended approval on 9 July 2026; Ofgem received the final modification report five days later. On 14 September, Ofgem said it could not form an opinion on P494 as submitted and sent it back for more work.

The reason is exact. Elexon’s report relied mainly on the UK GDPR “public task” basis, with “legitimate interests” for some processing. Ofgem says those bases address how personal data may be processed; they do not give Elexon the legal authority—its vires—to establish and operate a repository. Ofgem’s proposed fix is to amend condition E1 of the Electricity System Operator licence so the Balancing and Settlement Code can authorise that new function. A code amendment cannot create a power the licence has not supplied.

There is a second seam in the chain. Suppliers already send meter readings into settlement. Some asked whether processing those readings later for non-settlement purposes could breach their existing electricity-supply licence condition, SLC 47. Ofgem’s draft would amend that condition so suppliers can obtain and provide the relevant half-hourly data for storage in the repository. The draft notice describes the proposed supplier step; the statutory consultation sets out the wider licence and governance design.

Consent has a job, but it is not the whole building permit. Ofgem separates placing data into the repository from releasing identifiable, MPAN-level data to a third party. Its proposal relies on a licence and BSC framework for storage and retention. Access to personal data by a third party would require express, informed consent through the Consumer Consent Solution. Aggregated data and identifiable household data therefore sit behind different access conditions.

Ofgem also wants a tighter fence around the repository’s first version. Its proposed initial scope covers available half-hourly electricity-consumption data from Supplier Volume Allocation and Central Volume Allocation sources. For at least the first year after approval, the repository would stay within electricity-settlement data and associated data approved by the Authority. A material expansion would require prior approval. Proposed operating duties include fair and non-discriminatory access and charging, security and privacy controls, independent audit and transparent reporting.

That list still needs its working parts. Ofgem says P494 lacks detailed SDR Rules, an Operations Manual, a data-protection impact assessment package and related operational guidance. Those documents would spell out onboarding, access controls, identity checks, API and report catalogues, monitoring, assurance and incident handling. Ofgem told Elexon to develop and consult on the missing material, then submit a revised report and legal text with the complete supporting documents by 15 December 2026.

The licence consultation closed on 19 October and is awaiting a decision. Ofgem’s live energy-code timetable lists P494’s decision date as “to be announced.” The clock for the licence consultation and the clock for P494 are separate. A consent platform can authenticate a permission; the licence, code, manual and audit trail must still say what Elexon may hold, who can reach it, and how the arrangement is checked.