On 19th June, The Data Use & Access Act (DUAA) comes into effect
There's a new stage in the General Data Protection Regulations (GDPR) coming into effect on 19th June 2026. It's called The Data Use & Access Act (DUAA) and as a business owner, you need to make sure you are compliant.
What is the Data Use & Access Act?
The DUAA is a 'new Act of Parliament that updates some laws about digital information matters.' [1]
It has come about to 'change data protection laws in order to promote innovation and economic growth and make things easier for organisations, whilst it still protects people and their rights.' [1]
The key points for you to know
As a business owner who is responsible for data protection and handling the Personal Identifiable Information (PII) of others, you need to know:
All businesses that collect Personal Identifiable Information (PII) need to make sure they have a clear, understandable and accessible complaints procedure in place so that someone can make a complaint on how you are processing and/or using their PII
If you receive a complaint you must firstly acknowledge it within 30 days, investigate it and then clearly communicate the outcome to the complainant 'without undue delay' (or in more simple terms, ASAP)
What happens if I don't follow it?
This is a legal obligation as is the rest of the GDPR. Failure to comply could lead to penalties of up to 4% of your business' annual revenue. [1] I'm sure you'll agree it's not a risk worth taking.
What do I need to do?
1 Get a clear complaints procedure in place, pronto
It doesn’t have to be anything fancy, you just need to have one. It could be as simple as a basic online form.
Be mindful that you might want to keep a copy of complaints if you’re ever asked for them, so you want something that can save them.
2 Update your privacy policy to clearly explain your complaints policy and its timescales
Once you have decided what your complaints process and tools will be, you MUST update your privacy policy to include it by 19th June when this legislation comes fully into effect.
As with any legal wording, make it as clear and understandable as possible and include the timescales of when you will answer complaints to manage expectations.
3 Inform your clients and customers that you have updated your privacy policy, clearly telling them what you have added and/or changed
Finally, you must inform your customers, clients, subscribers (anyone whose PII you may process, basically) whenever you update your privacy policy.
Tell them the date you updated it and give a brief summary of the changes so they always stay in the loop - this is also a legal obligation for you.
This blog is for informative purposes only and not to be taken as legal advice, but hopefully it helps you stay up to date as a business owner!
For any further support with your business, take a look at some of our services that could help you with customer experiences: