It is now over half a decade since the UK left the EU data protection framework. But has much changed? After several years of debate, a reforming Data (Use and Access) Act was enacted in 2025. However, it will be argued that its substantive impact is relatively limited. Separately and as importantly, the (UK) General Data Protection Regulation (GDPR) has been deprived of its supremacy vis-à-vis exemptions set out in the Data Protection Act and data protection is no longer a fundamental right in the UK. Most significantly, Brexit and, to an extent, the Data (Use and Access) Act have furthered and cemented a very different enforcement stance by the UK’s Data Protection Authority compared to both the GDPR’s promise and the EU norm.  For example, whereas data protection fines issued within the EU in 2024 totalled €1,254 million (around £ 1,062 million), the UK total for 2024/25 was only around £4 million (despite the EU's resident data subject population being only around 6.5 times that of the UK). The UK regulator's restrictive approach raises troubling questions for the future of data protection as a truly legal framework.