Summary

The Data (Use and Access) Act 2025 (DUAA) mandates that all data controllers in the UK implement a formal process for handling data protection complaints by 19 June 2026. This requirement is part of broader amendments to the UK's data protection framework.

Key Points

• The DUAA received Royal Assent on 19 June 2025.
• All data controllers must comply with the new complaint handling process by 19 June 2026.
• The Act introduces significant changes to the UK's data protection regime.
• There are no exceptions to this requirement for data controllers.

Analysis

The introduction of the DUAA represents a significant shift in the UK's data protection landscape, emphasizing the importance of formalized complaint handling processes. This change underscores the increasing regulatory focus on data protection and the accountability of data controllers. IT professionals must be aware of these changes to ensure compliance and avoid potential penalties.

Conclusion

IT professionals should begin preparing for the implementation of the DUAA's requirements by reviewing and updating their data protection complaint handling processes to ensure compliance by the 2026 deadline.