What the recent data protection updates mean for your business (in plain-English)

From 19 June 2026, every organisation that processes personal data must have a formal, accessible process for handling data protection complaints.

Previously, if someone had a concern about how you handled their data, they could go straight to the ICO. Under the new rules, they must be able to bring that complaint to you first — and you must have a proper process in place to handle it.

In practice, your complaints process needs to:

• Include an accessible way for people to submit a complaint — an online form, email address, or both.
• Acknowledge complaints within 30 days.
• Investigate and respond without undue delay, keeping the person updated.
• Be clearly signposted in your privacy notice and on your website.

Think of this as adding a ‘first line’ of dispute resolution before people escalate to the regulator. Handled well, it’s an opportunity to resolve issues directly. Handled poorly, it increases the risk of ICO involvement.

What to do before 19 June 2026

✅ Make sure the right person in your business knows how to handle these complaints.

✅ Set up a clear route for people to submit data protection complaints (email address or online form).

✅ Write a simple internal complaints process covering how you receive, acknowledge and respond.

✅ Update your privacy notice to signpost the new complaints route.

This is one of the most practical changes for any scaling business with a website.

The DUAA adds five new categories of cookies that no longer require consent upfront — provided the conditions are met and you give people an easy way to opt out. The five exemptions are:

• Analytics cookies — collecting aggregate statistics to improve your website or service.
• Security cookies — used for fraud prevention and device security.
• Functionality cookies — that enhance service features or tailor the user interface.
• Software update cookies — for delivering updates.
• Interface customisation cookies — for adapting how your site looks to user preferences.

Strictly necessary cookies (the ones your site needs to function) continue to work exactly as before.

A few important caveats. Each exemption only applies where the cookie is used solely for that stated purpose. If an analytics cookie also feeds into advertising targeting, it does not qualify. And advertising cookies — including most social media and ad-network trackers — still require consent.

The ICO is finalising its updated cookie guidance, so watch for that in spring/summer 2026.

What to check

🔍 Audit what cookies and tracking tools your website actually uses and what each one does.

🔍 Check whether each cookie fits one of the five new exemptions — or still needs consent.

🔍 Update your cookie banner and cookie notice to reflect your current setup accurately. You should check with your cookie banner provider (e.g. CookieBot) to find out if the banner you are using has been updated. The good news is it may mean your cookie banner can be simplified!

🔍 Remember: advertising and social media cookies still require consent.

If your business uses suppliers or tools that process personal data outside the UK — cloud software, payment platforms, email tools — this section is relevant to you.

The legal test for international transfers has been updated. The focus is now on whether the level of data protection in the receiving country is ‘not materially lower’ than UK standards. This is a slightly more flexible test than before, designed to make international data flows more practical.

It doesn’t remove your obligation to know where your data goes. It’s also worth noting that the EU renewed the UK’s adequacy decision in December 2025, which means UK data can continue flowing to the EU without additional safeguards for now.

What to check

🔍 Map which suppliers or tools send or process personal data outside the UK and where.

🔍 Review your contracts and data transfer arrangements with key providers.

As covered above, PECR fines now match UK GDPR levels. This is the single biggest risk change for most scaling businesses that do any form of email or text marketing.

The Act also introduces a single, consistent definition of direct marketing: any advertising or marketing material sent to specific individuals, by any method. And PECR now covers attempted calls and messages, even if they don’t connect or aren’t delivered.

If you’ve been treating PECR compliance as a lower priority than UK GDPR, that calculation has changed.

What to check

🔍 Review your marketing emails, texts and outreach processes end to end.

🔍 Make sure your opt-out and unsubscribe process is easy to use and genuinely works.

🔍 Check that your records clearly show when consent was given — or what legal basis you’re relying on instead.

🔍 Brief anyone in your team who handles marketing on the updated rules.

Legitimate interests is one of the legal bases you can use to justify processing someone’s personal data. Normally, you need to work through a balancing exercise before relying on it.

The DUAA creates a new, shorter list of ‘recognised’ legitimate interests — specific purposes where you can skip that exercise entirely. These are:

• National security, public security and defence.
• Detecting, investigating or preventing crime.
• Responding to requests from public bodies acting in the public interest.
• Safeguarding vulnerable individuals.

The Act also confirms a broader (but non-exhaustive) list of activities that may qualify as legitimate interests — including direct marketing and intra-group data sharing — though these still require a balancing assessment. 

This change won’t affect most scaling businesses day to day, but it’s worth knowing about if any of your processing falls into the categories above.

What to check

🔍 Review whether any of your existing data processing falls into one of the four recognised categories.

🔍 Update your privacy notice and internal records if this applies to you.

A data subject access request (DSAR) is when someone asks you to share the personal data you hold about them. The DUAA makes a few useful clarifications.

You now only need to carry out ‘reasonable and proportionate’ searches when responding. This codifies in law what was already good practice: you don’t need to check every system exhaustively if doing so would be disproportionate.

The ‘stop the clock’ rule is also now in effect. If you need more information from the person to fulfil their request — for example, to clarify what they’re asking for or to verify their identity — you can pause the one-month response deadline until they respond.

🔍 Update your DSAR process and template responses to reflect the ‘reasonable and proportionate’ standard. And if you don’t yet have a documented process – be sure to implement that now.

🔍 Add a clear step for when you need to request clarification, and document how you track the paused clock.

🔍 Make sure the right person knows how to handle these requests.

If you run or work for a charity, there’s a new ‘charitable purpose soft opt-in’ under PECR. In certain situations, you can send marketing or fundraising messages without prior consent — where someone has already shown interest or support, and there’s a clear opt-out in every message.

This is a PECR-specific change. UK GDPR still applies in full. And remember: with PECR fines now at GDPR levels, getting this wrong costs a lot more than it used to.

What to check

🔍 Review how you collect supporter details and what wording you use at sign-up.

🔍 Ensure every message includes a clear, one-step opt-out.

The DUAA relaxes some of the restrictions on automated decision-making (ADM) – where a system makes a significant decision about someone without human involvement, such as in recruitment or credit scoring.

Under the previous rules, this was only permitted in specific circumstances. The new rules allow it more broadly, but with safeguards: you must be transparent about it, give people a way to challenge the decision, and ensure meaningful human oversight is available.

If your business processes data about children or operates a service children are likely to use, there is also an explicit new duty to take their specific needs into account when making decisions about how their data is used.

What to check

🔍 If you use any automated processes to make decisions about individuals, review them for transparency and human oversight.

🔍 If children are likely to use your service, review how you handle their data against the new children’s protection requirements.