Upcoming UK Data Protection Changes: What Employers Need to Know

We wanted to share an update following some recent training we attended on upcoming changes to UK data protection law.

While data protection is not an area we typically advise on directly, we thought it would be useful to highlight some of the key changes coming into effect and what they may mean for your organisation from an HR and employment perspective.

From 19th June 2026, provisions under the Data (Use and Access) Act 2025 will come into force, introducing a number of practical requirements for organisations handling personal data.

What are the key changes?

A formal data protection complaints process will become a legal requirement

Organisations will need to have a clear process in place for individuals who wish to raise a data protection complaint.

This means businesses should ensure they have:

• A clear route for submitting data protection complaints;

• A process for acknowledging complaints within 30 days; and

• A system for managing complaints and keeping individuals updated without unnecessary delay.

  
  

For many organisations, this may be a relatively simple update to existing complaints procedures, for example by introducing a dedicated contact route such as an email address for data protection concerns.

New requirements around acknowledging complaints

One of the key changes is the requirement to acknowledge data protection complaints within 30 days.

It is important to note that this requirement relates to acknowledging the complaint, rather than resolving it fully within that timeframe.

However, organisations should ensure individuals are kept informed throughout the process and that complaints are handled appropriately.

Changes to Subject Access Requests (DSARs)

There are also changes to how organisations can manage Subject Access Requests.

The updates provide some additional flexibility, particularly where requests are very broad or unclear. Organisations may be able to pause the response timeframe while seeking clarification from the individual and will only be expected to carry out searches that are considered reasonable and proportionate.

From an HR perspective, this is likely to be one of the more operationally relevant changes, particularly for employers who regularly deal with requests for employment records.

Clarification around direct marketing rules

The changes also provide further clarity around direct marketing and the use of legitimate interests as a lawful basis.

However, existing PECR (Privacy and Electronic Communications Regulations) requirements continue to apply. This means consent may still be required in many electronic marketing situations, particularly when contacting individuals rather than business contacts.

What should employers consider doing?

Ahead of the changes coming into effect, organisations may wish to review their current processes and consider:

• Updating complaints procedures to include a specific route for data protection complaints;

• Ensuring privacy notices explain how individuals can raise concerns about the use of their personal data;

• Reviewing internal processes for managing Subject Access Requests;

• Checking that marketing activity remains compliant with PECR requirements.

  
  

Final thoughts

For many organisations, these changes should be relatively straightforward to implement.

However, it is important to ensure the right processes are in place before the June deadline and that those responsible for handling employee and customer data understand any updated requirements.

As always, taking the time to review and update your processes now can help avoid issues later.

If you have any general HR-related questions about how these changes may impact your organisation, please feel free to get in touch.