Data protection in 2026: getting ready for the DUAA

The Data (Use and Access) Act 2025 brings a new duty for every organisation to handle data-protection complaints — live from 19 June 2026. Here's what SMEs need to do.

UK data-protection law is changing. The Data (Use and Access) Act 2025 (DUAA) received Royal Assent in June 2025 and is being brought in over a series of stages. It doesn't replace UK GDPR — it amends it — but one change in particular has a hard deadline that every SME should have in its diary.

The complaints duty — live 19 June 2026

From 19 June 2026, every organisation that handles personal data (a "controller") must have a formal process to handle data-protection complaints from individuals — before those complaints escalate to the regulator. In practice that means you must:

• Give people a clear way to raise a data-protection complaint directly with you — for example, an electronic complaint form.
• Acknowledge a complaint within 30 days of receiving it.
• Take appropriate steps to respond without undue delay, and keep people informed.
• Tell people the outcome of their complaint.

The ICO has confirmed organisations should be ready to accept complaints through any reasonable channel — not just a single form — including informal routes. Existing complaint frameworks can usually be adapted rather than rebuilt.

What else the DUAA changes

The Act also clarifies subject-access-request timelines (including a "stop the clock" rule), introduces a new "recognised legitimate interests" basis, and tidies up rules on automated decision-making and cookies. Notably, penalties under the related PECR marketing rules now align with UK GDPR levels — up to £17.5 million or 4% of global turnover — so getting the basics right matters more than ever.

What SMEs should do now

• Put a documented data-protection complaints process in place before 19 June 2026.
• Update your privacy notice to tell people how to complain.
• Review your lawful bases and subject-access procedures against the new rules.