Changes in UK GDPR law under the Data Use and Access Act 2025

Data protection law in the UK is changing, so it is important you know what the changes mean for your organisation and ensure it is compliant.  

The Data Use and Access Act 2025 (DUAA) was enacted last year to reform UK data protection law, with many of the changes coming into effect from 19 June 2026. From that date, all organisations that hold and process personal data will have a legal obligation to enable people to make a data protection complaint.  A data protection complaint is when someone believes the way in which you have handled their personal data infringes data protection law.  

Some of the practical implications for organisations under the DUAA from 19 June 2026 include:

• You must have a Data Protection Complaints Policy, setting out how you will manage a data protection complaint. There are no exceptions; all organisations processing personal data must have one.
• You must give people a way to make a data protection complaint against your organisation.
• All data protection complaints must be acknowledged within 30 days of receipt.
• All data protection complaints must be dealt with without undue delay. This includes taking appropriate steps to gather the information you need to adequately respond to the complaint and keeping the person complaining updated.
• You must inform the person making the complaint of the outcome without undue delay.

If you want to discuss your organisation’s Data Protection Complaints Policy or want to understand your organisation’s obligations under the DUAA, please do contact us on 01892 515022

This blog is not intended as legal advice that can be relied upon.