Skip to contact
Seamwork AI
Book a free call
← Blog

What did the Data (Use and Access) Act change?

For most small businesses, the Data (Use and Access) Act 2025 changed one thing you have to do: since 19 June 2026, you must have a process for handling data protection complaints. The ICO's guidance on complaints is unusually direct about it: "You must have a process for handling data protection complaints within your organisation - there are no exemptions to this."

Nearly everything else in the Act widens what you're allowed to do rather than adding to what you must do. The one other change worth your attention is a much higher maximum fine for getting marketing emails and cookies wrong. If you only have five minutes, read the complaints section and the fines section, and you'll have what matters.

It amends the law, it doesn't replace it

There's no new UK GDPR. Think of it as an extension and some rewiring on an existing house, not a new build. The ICO's own summary says the Act "amends, but does not replace" the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations. Your privacy notice, your reasons for holding data, how long you keep things and how you report a breach all still work the way they did.

The Act got Royal Assent on 19 June 2025 and was switched on in stages, a bit like a building opening one floor at a time. The main data protection changes came into force on 5 February 2026 under the sixth commencement regulations, and the complaints rules followed on 19 June 2026. Every data protection provision in the Act is now in force. That's worth knowing, because a lot of articles written in 2025 still describe these changes as coming soon, and some of them still rank well in search results.

The one thing you now have to do

Section 103 added a new section 164A to the Data Protection Act 2018. If someone thinks you've mishandled their personal data, they can complain to you directly, and you must:

  • make it easy to complain - the Act gives "providing a complaint form which can be completed electronically and by other means" as an example of what's expected;
  • acknowledge the complaint within 30 days of receiving it;
  • respond without undue delay, looking into it as far as is appropriate, keeping the person updated and telling them the outcome.

For a five-person business this isn't a big project. It's an email address or form that someone actually checks, and the habit of replying. The realistic risk isn't the paperwork. It's a complaint that lands in a shared inbox in July and nobody spots until September, by which point the 30 days have gone.

That's exactly the sort of routine step automation handles well. If you'd like complaints logged somewhere as they arrive, with a reminder well before the 30-day mark, we're happy to set up an automation that does that for you.

One related tidy-up: the Act removed Article 77 of the UK GDPR, the right to complain to the regulator. That right still exists, it just now sits in section 165 of the Data Protection Act 2018. In practice nothing changes for you.

"Recognised legitimate interests" probably won't apply to you

To use personal data you need a lawful reason, and "legitimate interests" is one of them. Normally it comes with a balancing test: you weigh up why you need the data against what the person would reasonably expect, like checking both sides of a scale before you act.

This change is often described as a gift to business, so it's worth reading the actual list. Schedule 4 added a new Annex 1 to the UK GDPR, and the recognised legitimate interests are: passing data to another organisation that needs it for a public task; national security, public security and defence; emergencies; detecting, investigating or preventing crime; and safeguarding vulnerable people.

Where one of those applies, you can skip the balancing test. If you run a letting agency or a design studio, it will very rarely apply. It's mainly for organisations that hand data to the police and similar bodies.

Separately, and more usefully, section 70 added wording to Article 6 giving examples of processing that "may be" a legitimate interest. Direct marketing is on that list, along with sharing data within a group of companies for internal admin, and network security. That's a helpful clarification. It isn't a free pass, though: you still do the balancing test, and the separate consent rules for marketing emails and texts still apply.

Subject access requests have a clock you can pause

A subject access request is when someone asks you for a copy of the personal data you hold about them. It's the data equivalent of asking to see your file.

Section 76 changed the deadline by adding a new Article 12A to the UK GDPR. You still have one month, but it now starts from the latest of three moments: when you receive the request, when you receive any information you asked for to confirm who the person is, and when any fee you've charged is paid. If you reasonably need more information to work out what data or activities the request is about, which the law says can happen when you hold a lot of information about someone, you can ask them, and the days from when you ask until they reply don't count towards the month. You can still extend by two further months where the requests are complex or numerous, but you have to tell the person, with your reasons, before the first month is up.

This applies only to requests received on or after 5 February 2026. Anything that arrived earlier runs under the old rules.

Section 78 also put into law that your search only has to be "reasonable and proportionate". Unusually, it was in force at Royal Assent and is treated as having come into force on 1 January 2024. It describes what the ICO already expected, rather than giving you permission to look less carefully.

The hard part of a subject access request is usually finding everything, because a customer's details can be spread across your inbox, your accounts software, a booking system and a spreadsheet or two. If gathering those records together is the job you dread, we're happy to set up an automation that pulls them into one place so you can review them.

Fewer cookie banners, but not none

A cookie is a small note a website leaves in your browser, like a cloakroom ticket, so it can recognise you or remember something next time. Normally you need consent before a site stores one.

Schedule 12 added new exceptions to that rule. Two matter for an ordinary business website: collecting statistics about how people use your site so you can improve it, and remembering preferences that change how the site looks or works.

Both come with conditions. You must give clear and comprehensive information about what you're doing and a simple, free way to object, and the person mustn't have objected. For the statistics exception, the information mustn't be shared with anyone other than someone helping you make those improvements.

That last condition is where things get less clear. Whether a particular third-party analytics product fits inside the exception depends on what its provider does with the data for its own purposes, and that isn't something the law answers product by product. Advertising and cross-site tracking cookies still need consent, as before.

The maximum fine for marketing rules went up thirty-five-fold

This is the change most likely to matter to a small business. The Privacy and Electronic Communications Regulations, usually shortened to PECR, are the rules for marketing emails, texts, calls and cookies, and they're the part of data law small businesses most often trip over.

PECR fines used to run through the old Data Protection Act 1998 system, where the maximum was £500,000. Since 5 February 2026 they run through the Data Protection Act 2018 instead, with the same two levels as UK GDPR. Under Schedule 1 to PECR and section 157 of that Act, breaking the cookie rules or the rules on marketing emails, texts and calls, along with a few rules that mainly affect phone and internet providers, can bring a fine of up to £17.5 million or 4% of worldwide annual turnover, whichever is higher. The rest of PECR is capped at the standard level of £8.7 million or 2%. In the ICO's own words: "The DUAA also gives us the power to issue fines of up to £17.5 million or 4% of global turnover under the Privacy and Electronic Communications Regulations (PECR)."

The new maximums only apply to things done or not done on or after 5 February 2026. Anything earlier is still dealt with under the old rules, with the old £500,000 cap. A maximum isn't a guide to what anyone will actually be fined. But the old cap has gone, and the ICO has said it's writing separate guidance on the higher fines.

The practical protection is being able to show that everyone on your mailing list agreed to be on it, and when. That tends to go wrong when sign-ups arrive through a website form, a booking system and a card on the counter, and get copied across by hand. If that's how your list gets built, we're happy to set up an automation that moves each sign-up into your mailing tool with the date and source recorded.

The regulator became the Information Commission on 30 September 2026

The last piece of the Act changes who's in charge at the regulator rather than what you have to do. Regulations made on 10 September 2026 set 30 September 2026 as the day the office of Information Commissioner was abolished and its work passed to a new Information Commission, run by a board rather than by one person. Most of section 117, which creates the Commission, has been in force since 20 August 2025, and seven non-executive board members were appointed in July 2026.

For a small business it's closer to a change of management than a change of rules. The regulator has said it's maintaining its existing regulatory functions and responsibilities and "will continue to be known as the ICO". The UK GDPR, the Data Protection Act 2018 and PECR still apply as described above.

What should you do now?

If you have a way for people to complain, an inbox someone checks and the habit of acknowledging complaints within 30 days, you've met the only new duty in the Act.

If you send marketing emails, use tracking cookies or buy in contact lists, the higher PECR fines are the one change that moved the risk towards you, and it's worth an hour checking your consent records hold up.

Otherwise, there's nothing you need to do. The rest of the Act gives you options you can use if they help and ignore if they don't.

If you're also wondering what happens to business data you put into AI tools, our article on whether AI trains on your business data covers that. And if the routine side of any of this, such as logging complaints, gathering records or recording where each sign-up came from, is eating your time, you can see what we do and get in touch.

Sources

Checked on 23 September 2026, and the move to the Information Commission on 1 October 2026. Data protection guidance is being revised after the Act, so check the ICO's current guidance before relying on any detail here. This is general information about the law, not legal advice.

The next step

The cost of waiting is not zero.

Somewhere in your market, a business the same size as yours has stopped writing follow-ups by hand. They are quoting faster than you, chasing money you are still chasing manually, and starting Monday already knowing where they stand. That gap does not stay the same size.

Half an hour on the phone. You describe your week, we tell you honestly which parts of it are worth automating and which are cheaper left alone. No pitch, and nothing to sign - you decide whether you want to take it further.

Book a free call

Or just ring us on 07816 970 768, or email hello@seamwork.co.uk.

We reply within a working day to have a chat about what we can provide and if we cannot help you we will say so, no pressure, no commitments, we just love showing off cool tech :)

We explain what we do with this in our privacy notice.