Significant changes to UK data protection legislation have been introduced through the Data Use and Access Act (DUAA) 2025, with implementation expected from 19 June 2026. Organisations handling personal data will be required to ensure that privacy notices and complaint procedures are updated to reflect these changes.
These reforms are intended to improve transparency, strengthen individual rights, and provide clearer processes for resolving data protection concerns before escalation to the Information Commissioner’s Office (ICO).
Failure to adapt internal processes and documentation could result in non-compliance with UK data protection law.
Mandatory Internal Complaints Procedures
Under the new provisions, organisations will be required to implement a formal and accessible data protection complaints procedure.
Previously, concerns relating to data protection could often be addressed informally. However, under the DUAA framework, a structured internal complaints process will be expected.
This means:
-
A clearly defined complaint process must be documented and made publicly available.
-
Individuals must be able to submit complaints directly to the organisation before approaching the ICO.
-
In many cases, digital submission options such as online complaint forms will be encouraged to ensure accessibility.
The introduction of mandatory procedures is expected to lead to a greater volume of complaints being received by organisations, making preparation essential.
30-Day Complaint Acknowledgement Requirement
A defined timeframe has also been introduced for the handling of complaints.
Organisations will now be required to:
-
Acknowledge complaints within 30 days, and
-
Provide a response without undue delay once the matter has been investigated.
These requirements are designed to ensure that individuals receive timely responses and that organisations address data protection concerns responsibly and transparently.
Updates Required to Privacy Notices
Privacy notices will also require revision to ensure compliance with the new legislation.
Privacy documentation will now be expected to clearly inform individuals:
-
That complaints may be submitted directly to the organisation, and
-
That individuals retain the right to escalate concerns to the Information Commissioner’s Office (ICO) if the matter cannot be resolved.
Ensuring that privacy notices remain accurate, transparent, and easily understood will be essential under the updated framework.
Changes to Cookie Consent Requirements
The DUAA reforms also introduce adjustments to the way certain cookies may be used.
Under the updated rules, some forms of non-essential data collection for statistical and service improvement purposes may be permitted without explicit user consent.
While this may simplify certain analytics practices, organisations must still ensure that:
-
Data usage remains transparent, and
-
Privacy notices clearly explain how data is collected and used.
Failure to maintain transparency could still result in regulatory scrutiny.
Preparing Your Organisation for Compliance
With these changes approaching implementation in June 2026, organisations should begin reviewing their existing documentation and procedures.
Key areas requiring attention include:
-
Updating Privacy Policies and Privacy Notices
-
Implementing or formalising a Data Protection Complaints Procedure
-
Ensuring that complaint submission methods are accessible
-
Preparing teams to manage an increase in complaint volumes
-
Reviewing cookie usage and consent practices
Early preparation will help ensure that compliance obligations are met without disruption to business operations.
Ensure Your Data Protection Framework Is Up to Date
Keeping pace with evolving data protection legislation can be complex, particularly when new procedural requirements are introduced.
Support with Privacy Policy updates, complaints procedures, and wider data protection compliance can be provided by Ilisi Expert Legal Compliance.
For further information or to discuss your organisation’s requirements, contact Ilisi Expert Legal Compliance.
📞 Telephone: 01444 811434
📧 Email:
