If your website collects anything about the people who visit it, and almost every business website does, 19 June 2026 is a date for your calendar. From that day a new legal duty applies to every UK organisation that handles personal data. Plenty of small business sites are quietly falling short already, without their owners realising. Here is what has changed, what it means for you, and how we can put it right with a one-off compliance audit. What has actually changed The Data (Use and Access) Act 2025, or DUAA, is the biggest change to UK data protection law since GDPR. It doesn’t tear up the rules you already know. It amends three of them together: the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations that govern cookies and marketing email. Most of the Act came into force in February 2026. One duty was held back to 19 June 2026, and it is the one most businesses have done nothing about. The 19 June duty in plain English From that date, every organisation must have a proper process for people to complain about how their personal data is handled. A contact form buried three clicks deep no longer counts. You need to give people an accessible way to complain, including an electronic form they can fill in. You must acknowledge a complaint within 30 days, investigate it without delay, and tell the person the outcome. You also have to spell out their right to complain in your privacy notice. If your site does not visibly offer that today, it will not meet the standard. Frequently Asked Questions What is the key change coming into effect on 19 June 2026? From 19 June 2026, every UK organisation handling personal data must have a proper process for people to complain about how their data is used. This includes providing an accessible electronic complaint form, acknowledging complaints within 30 days, investigating them promptly, and informing the complainant of the outcome. The requirement also mandates that this right is clearly stated in your privacy notice. How do the new cookie rules affect my website? The updated rules now cover tracking pixels, scripts, and device fingerprinting, not just traditional cookies. Your consent banner must genuinely control these trackers, meaning analytics and marketing tags should not load or store data until the visitor agrees. Some low-risk analytics cookies are exempt, but exemptions vanish if tags serve dual purposes, like feeding advertising data. What happens if my website isn’t compliant by 19 June 2026? Non-compliance can result in penalties up to £17.5 million or 4% of global turnover, matching GDPR-level fines. Beyond financial risks, you may face complaints you can’t handle properly, regulatory inquiries, or loss of customer trust. The regulator has stated it will actively test UK websites and act against those falling short. Support the show Need an Agency that works with you? Contact: https://hertfordshirewebdesign.com/
