The PSTI Regulations that the bill gives legal effect to are here: https://www.legislation.gov.uk/uksi/2023/1007/schedule/1/mad...

  (2) Passwords must be—
   (a)unique per product; or
   (b)defined by the user of the product.
  (3) Passwords which are unique per product must not be—
   (a)based on incremental counters;
   (b)based on or derived from publicly available information;
   (c)based on or derived from unique product identifiers, such as serial numbers, unless this is done using an encryption method, or keyed hashing algorithm, that is accepted as part of good industry practice;
   (d)otherwise guessable in a manner unacceptable as part of good industry practice.