Data (Use and Access) Act 2025: what changes for UK small business websites

When it came into force

The Act received Royal Assent on 19 June 2025. It has been brought into force in stages by commencement regulations, which GOV.UK tracks on its commencement plans page. The dates that matter for most websites are:

5 February 2026: most of the data protection and privacy changes, including the new cookie exceptions and higher PECR fines. The ICO’s commencement statement confirms this date.
19 June 2026: the duty to handle data protection complaints (section 103 of the Act), under regulation 3 of SI 2026/82.
30 September 2026: the Information Commissioner’s functions moved to a new body, the Information Commission. It still uses the ICO name and website.

Some practical detail is still settling. The ICO is still publishing and updating guidance, and the government has been considering further changes to the cookie rules for advertising. Where we’re unsure, we say so below. If you’re reading this some months after the date at the top, check the commencement page for anything new.

1. Cookies and analytics: some no longer need consent

The cookie rule is still in the Privacy and Electronic Communications Regulations 2003 (PECR): you need consent to store or read information on a visitor’s device unless an exception applies. The Act added a list of exceptions in Schedule A1 to PECR. The ICO explains them on its exceptions page. For a typical website the useful ones are:

Statistical purposes: analytics used only to improve your own website or service.
Appearance: remembering how a visitor wants the site to look, such as language or text size.
Strictly necessary: things the visitor asked for, such as a basket, log-in or security.

The analytics and appearance exceptions come with conditions. You must tell people clearly what you do and give them a simple, free way to object. Analytics data must not be shared except to help you improve the site. If your analytics tool uses the data for its own purposes or for advertising, it is unlikely to qualify.

Advertising still needs consent. Ad pixels, retargeting tags and similar tools are not exempt (see the ICO’s guidance on online advertising). Possible future exceptions for some lower-risk advertising have been discussed, but at the time of checking nothing had changed in law. Our cookie banner guide covers how to set up and test the banner.

2. You must handle data protection complaints yourself

Since 19 June 2026, section 164A of the Data Protection Act 2018 gives people the right to complain to you about how you use their personal data. Every organisation that handles personal data is covered, including sole traders. In practice you need to:

make complaining easy, for example with a complaint form that can be completed electronically;
acknowledge each complaint within 30 days;
take appropriate steps to look into it, and keep the person updated;
tell them the outcome without undue delay.

Your privacy notice should now say how to complain to you as well as to the ICO. The ICO has published guidance on handling complaints. In its June 2026 announcement it said its focus is on helping organisations build good practice, not on catching businesses out. Our privacy notice guide shows where the complaints wording fits.

3. PECR fines now match UK GDPR levels

For breaches on or after 5 February 2026, the maximum fine for the main PECR rules (cookies, marketing emails, texts and calls) rose from £500,000 to the UK GDPR level: £17.5 million or 4% of worldwide annual turnover, whichever is higher. The amendments are in Schedule 13 to the Act. That is a ceiling, not a typical amount. Our PECR fines guide explains the change in detail.

4. Other changes worth knowing

Subject access requests. You only need to make reasonable and proportionate searches. You can also “stop the clock” while you wait for a clarification you genuinely need. See the ICO’s guide to subject access.
Recognised legitimate interests. A new lawful basis covers a short, fixed list of purposes, such as preventing crime, safeguarding and emergencies, without a balancing test. It does not cover everyday marketing. For that you still rely on consent or ordinary legitimate interests, plus the PECR rules.
Charity soft opt-in. Charities can now email supporters and people who have shown an interest in their work, unless those people object.
Stronger ICO powers. The regulator can now require people to attend interviews and can require technical reports.

The ICO’s overview, what the DUAA means for organisations, and GOV.UK’s summary of data protection and privacy changes list the full set.

What isn’t certain yet

Guidance timing. The ICO is still consulting on and finalising some guidance. The law is in force, but the detailed expectations may still be refined.
Advertising cookies. Any future exception for lower-risk advertising would need new law. Until then, treat all ad tags as needing consent.
How enforcement will look. There is no track record yet of how the higher PECR maximums or the complaints duty will be enforced against small businesses. We can’t predict outcomes, and you should be wary of anyone who claims to.

Quick checklist

List every cookie and tag your site sets, and mark which ones fit an exception
Keep consent for advertising pixels and any analytics that shares data with the provider
If you rely on the analytics exception, explain it clearly and offer an easy way to object
Add a simple, electronic way to make a data protection complaint
Set up a process to acknowledge complaints within 30 days and track the outcome
Update your privacy notice: how to complain to you, and to the ICO
Brief whoever handles subject access requests on proportionate searches and stopping the clock
Re-check after adding plugins, changing your theme or starting new ad campaigns

FAQ

When did the Data (Use and Access) Act come into force?

It received Royal Assent on 19 June 2025 and was brought in by stages. Most data protection changes, including the new cookie exceptions and higher PECR fines, started on 5 February 2026. The complaints duty started on 19 June 2026.

Do I still need a cookie banner?

If your site uses advertising pixels, or analytics that don’t meet the exception’s conditions, yes. If everything you use falls within an exception, you don’t need consent for it. You still need to explain clearly what you do and, for analytics and appearance cookies, give an easy way to object.

Does a sole trader need a complaints process?

Yes. The duty in section 164A of the Data Protection Act 2018 applies to controllers of personal data generally, whatever their size. It can be simple: a clear contact route or form, an acknowledgement within 30 days, and a record of what you did.

Is the ICO still called the ICO?

Since 30 September 2026 its functions have sat with the Information Commission, but it still uses the ICO name and ico.org.uk.

Is this legal advice?

No. It’s a general summary of the rules with links to official sources.

Official sources

Laws and guidance change. Check the sources above for the latest position. For advice on your own circumstances, consult a solicitor.

The Data (Use and Access) Act 2025: what changes for a UK small business website