A business's data-protection procedures should describe how it actually handles personal information. The Data (Use and Access) Act 2025 has amended parts of the existing framework, making a review of those procedures worthwhile, particularly where complaints are still handled informally or responsibility is unclear.
The Act does not replace the UK GDPR. Nor does it create a general permission to collect or share personal information. Organisations still need to consider the applicable lawful basis, transparency, security and individual rights when using data.
Implementation has taken place in stages
Most of the Act's data-protection and privacy amendments took effect on 5 February 2026. The new complaints-handling duties followed on 19 June 2026. Separately, functions of the Information Commissioner transferred to the Information Commission on 30 September 2026, under the relevant commencement and transitional regulations.
These dates relate to different provisions. A policy announcement about smart data or digital verification does not establish that a particular business has acquired a new obligation; the relevant scheme, regulations and commencement provisions must be identified.
A complaints procedure must work in practice
Controllers must provide a way for individuals to raise data-protection complaints and acknowledge receipt within 30 days. They must also take appropriate steps to respond, investigate where appropriate, keep the complainant informed and communicate the outcome without undue delay.
The 30-day period is an acknowledgement deadline, not a general entitlement to leave a complaint unanswered for a month or a fixed deadline for completing every investigation. The response should reflect the complaint and the enquiries reasonably required.
A workable procedure identifies who receives complaints, who can access the relevant records and who is responsible for the response. Staff handling customer queries should be able to recognise a concern about personal information even if the individual does not describe it as a formal complaint. Keep a record of the issue, enquiries, communications and outcome, and use recurring complaints to identify weaknesses in the underlying process.
Check contracts against operational arrangements
Review which suppliers hold or use personal information for the business and whether their contractual duties match their actual role. Consider assistance with individual requests and complaints, incident reporting, retention and the return or deletion of information when a service ends.
A contract alone does not establish compliance. The business should be able to explain how access is controlled, how information moves between systems and how a request reaches the person able to deal with it. Where a new project involves sensitive information, data sharing or automated decisions, assess the specific requirements before implementation.
Balaghi & Rose advises on commercial agreements and legal risks associated with business data. Contact our team to discuss contractual arrangements or a particular data-related concern.
General information only. This article concerns UK data-protection law and reflects the position checked on 26 October 2026. It is not legal advice.
