A delegated law is a legislative tool that lets parliament set the main framework and then authorizes the government to write the detailed rules within fixed limits. In practice, it is used when the technical details are too complex or too changeable to place entirely in the primary statute.
In cyber security, delegated laws matter because they often define how broad duties become operational requirements: incident reporting, minimum controls, audit obligations, and rules for critical sectors such as energy, telecoms, and cloud services. For defenders, this can turn a high-level legal duty into concrete tasks like segmentation, logging, backups, and recovery testing. For attackers, a newly delegated regime can create a transition period where organizations are still adapting, especially if compliance is uneven across suppliers. The concept is important because good security policy depends not only on the law itself, but on how clearly and quickly its technical rules are written and enforced.