The debate surrounding the Data (Use and Access) Act 2025 (DUAA) has largely focused on the substance of the reforms: a more permissive automated decision-making regime, revised legitimate interests, changes to scientific research provisions, reforms to subject access requests, digital verification services and smart data schemes.

These are important developments, sure, but they may not be the Act’s most enduring legacy. Perhaps it is how much legislative authority has Parliament delegated to the Secretary of State to determine what UK data protection law will look like in five, ten or 20 years’ time?