UK GDPR Changes in 2026 – What Small Businesses Actually Need to Do
There has been a lot of discussion about changes to UK data protection law, and many small business owners are wondering whether they need to make major changes to remain compliant.
The good news is that the changes introduced under the Data (Use and Access) Act 2025 do not replace UK GDPR or the Data Protection Act 2018. Instead, they introduce a series of updates and clarifications, many of which are being phased in between June 2025 and June 2026.
For most small businesses, this is not a complete compliance overhaul. However, there is one area that deserves attention: how you handle data protection complaints.
What Is Changing?
The Data (Use and Access) Act 2025 introduces several updates to the UK's data protection framework. While many of these changes are aimed at improving clarity and reducing administrative burdens, businesses still need to demonstrate that they are handling personal data responsibly and transparently.
One of the most practical changes for small businesses is the introduction of clearer requirements for dealing with complaints from individuals about how their personal data is being used.
The New Complaints Handling Requirement
From 19 June 2026, organisations that process personal data will be expected to have a clear process for handling data protection complaints.
The Information Commissioner's Office (ICO) requires organisations to:
Provide a simple way for individuals to raise concerns.
Acknowledge complaints within 30 days.
Respond without undue delay.
Maintain records of complaints and how they were handled.
Importantly, a complaint does not need to use legal language or specifically mention "data protection" to qualify. If someone raises concerns about how their information has been collected, stored, shared or used, it should be treated as a potential data protection complaint and handled appropriately.
The aim is to ensure concerns can be addressed fairly and efficiently before an individual decides to escalate the matter to the ICO.
What Should Small Businesses Do?
Most businesses do not need expensive legal projects or complex compliance programmes.
Instead, this is a good opportunity to review the basics.
Create a Simple Complaints Procedure
Document:
How complaints can be submitted.
Who is responsible for handling them.
Response times.
Escalation steps if required.
Keep a Complaints Register
A simple spreadsheet or log is often sufficient.
Record:
Date received.
Name of complainant.
Nature of the concern.
Actions taken.
Date resolved.
Review Your Existing Documentation
Check that your:
Privacy Notice is up to date.
Data retention practices are documented.
Subject Access Request process remains clear.
Data protection responsibilities are assigned.
Train Relevant Team Members
Anyone responsible for customer service, administration or management should understand:
What constitutes a data protection complaint.
How complaints should be recorded.
When concerns need escalating internally.
The Real Risk
For many small businesses, the greatest compliance risk is not the law itself.
It is the absence of documented processes.
If a complaint is received and there is no clear procedure, no record of actions taken and no evidence of how concerns were addressed, it becomes much harder to demonstrate compliance if questions are later raised.
Good documentation creates consistency, accountability and evidence.
Final Thoughts
The changes introduced under the Data (Use and Access) Act 2025 are unlikely to require major operational changes for most small businesses.
However, the new complaints handling requirements provide a timely reminder that compliance is not just about policies. It is about having practical systems, clear responsibilities and documented processes that can be followed consistently.
A simple review now could help prevent unnecessary problems later
Need an outside pair of eyes to help you with your review, policies and training? Contact us for a chat.
https://calendly.com/hello-tem101/lets-have-a-chat
