The UK has taken a major step: what was once a soft-talked pilot idea for digital identity is now clearly anchored in law and government policy. For the first time in decades, digital identity in the UK is no longer just “nice to have” — it is becoming an instrument of governance, service delivery and border enforcement.

Legal Foundations: from Bill to Act

Earlier this year, the Data (Use and Access) Act 2025 (DUAA) received Royal Assent, establishing the regulatory groundwork for Digital Verification Services (DVS) and certified digital identity providers. The DUAA does more than tweak data protection — it provides the statutory authority to create a register of trusted providers, set out a trust framework, and regulate how digital identity can be verified across both public and private sectors.

In essence, the DUAA gives legal life to digital identity in the UK. It moves the discussion from voluntary pilots and fragmented industry efforts into the realm of enforceable public policy. The Act positions digital identity as a formal component of the nation’s data infrastructure and gives government departments the mandate to deploy and recognise trusted credentials.

Governmental Commitment: Mandatory for Right to Work

On 26 September 2025, the government published a press release titled “New digital ID scheme to be rolled out across UK”, confirming that a new digital ID will be mandatory for Right to Work checks by the end of this Parliament.

Key points:

• The scheme will be available to all UK citizens and legal residents and will live on people’s phones, leveraging the GOV.UK Wallet and One Login infrastructure.
• There is explicitly no requirement for individuals to carry a physical card or paper credential; the digital ID will satisfy employment-eligibility checks.
• The government frames the move as part of its plan to make the UK less attractive to illegal working by strengthening the right-to-work system.

What’s Real — and What’s Still Hype

What is real:

• The legal infrastructure now exists via the Data (Use and Access) Act 2025 (DUAA).
• A formal governmental commitment has been made to make digital ID mandatory — at least within the Right to Work domain.
• The Digital ID Scheme Explainer on GOV.UK lays out how the system will operate, including commitments to inclusion for those without smartphones.

What remains more hype than rollout:

• There is no secondary legislation yet published that enforces the digital ID requirement in law.
• The scheme is not yet live at national scale; wallet integration, certification of DVS providers, and service-by-service adoption are still in development.
• Use cases beyond Right to Work remain aspirational — such as digital driving licences, tax services, or welfare delivery.
• Critical aspects such as privacy safeguards, fallback options, and accessibility remain open to consultation.

Why It Matters

For organisations engaged in digital identity, trusted credentials, verifiable services and the broader cybersecurity ecosystem — including those focused on post-quantum security — this marks a pivotal turning point:

• The UK now has a legislated digital identity regime, meaning future compliance and certification obligations for both issuers and verifiers.
• A mandatory domain (employment eligibility) creates an immediate commercial use case for digital identity providers.
• The DUAA explicitly prioritises privacy-by-design and interoperability, aligning with evolving European and global standards — and setting a new benchmark for private-sector adoption.
• The infrastructure could also serve as a testbed for quantum-resilient identity systems, as encryption standards evolve toward post-quantum readiness.

Bottom Line for TQS’s Audience

The UK is no longer experimenting with digital ID as a policy concept — it has moved decisively into implementation. The Data (Use and Access) Act 2025 (DUAL) provides the legal foundation, and the Right to Work mandate signals the first wave of compulsory adoption.

What remains uncertain is the how: how privacy will be preserved, how inclusion will be guaranteed, and how resilient the new trust infrastructure will be under real-world conditions. For the identity and cybersecurity industries, the question is no longer if — it is how fast.

TQS will continue to monitor developments as the government publishes the secondary legislation and launches the first operational pilots in late 2025.

Sources

1. “New digital ID scheme to be rolled out across UK” – GOV.UK press release, 26 Sept 2025. (gov.uk)
2. “Digital ID scheme: explainer” – GOV.UK publication. (gov.uk)
3. “UK digital identity legislation passes another important milestone” – Office for Digital Identities blog. (enablingdigitalidentity.blog.gov.uk)
4. “Data (Use and Access) Act 2025” – GOV.UK legislation collection. (gov.uk)
5. “Enabling the use of digital identities in the UK” – GOV.UK guidance, Aug 2025. (gov.uk)
6. “Britain to introduce mandatory digital ID cards” – Reuters, 26 Sept 2025. (reuters.com)