The New 2026 UK Data Rules You Have Probably Missed
Remember GDPR?
We do.
After the panic, the effort, the running around making last minute changes to comply, in some ways it seemed a bit like a phoney war, the balloon went up and everyone expected the fines to start raining down … and there was, by and large, a deathly hush.
Except there wasn’t.
True, not everyone got slapped with huge fines but consider these bad boys:
- British Airways – £20 Million: The ICO determined that the airline lacked adequate IT security measures. This failure allowed a 2018 cyber attack to go undetected for over two months, leaking the personal and financial details of more than 425,000 customers.
- Marriott Hotels – £18.4 Million: The hotel chain was fined after it was discovered that a 2014 cyber attack had leaked 339 million guest records globally, including names, phone numbers and passport numbers.
- Reddit – £14.47 Million: In one of the largest penalties under the UK’s online safety and privacy rules for minors, the ICO fined Reddit for failing to protect children adequately [cite: 1.1.2]. The regulator found the platform was unlawfully processing the data of children under 13 because it lacked effective age-verification systems and relied instead on users simply declaring their age.
Source: https://measuredcollective.com/the-biggest-gdpr-fines-so-far-2026/
… and just in case you thought it’s only for the heavyweights (Meta fines reach comfortably into the billions), consider the London dispensing chemists who left some personal documents outside and copped for a £275,000 fine. That was later lowered to £94,000 on appeal but, still, that is a lot of paracetamol.
The point is, GDPR is here and here to stay. Get it wrong and it could easily cost you any sane person’s definition of everything.
At Little Fire we prattle on about how the Internet (and the world in which it operates) is not static. This week, Friday the June 19th 2026, the Data (Use and Access) Act 2025 (DUAA) comes into full legal effect
… and guess what? It’s another raft of compliance legislation with fines running into the many zeroes.
… and guess what? You, yes you, at SME Ltd is responsible.
So What to Do About It?
Read on, dear reader, read on.
Table of Contents
Before We Go On
… and boy, can we go on.
At Little Fire Digital, we believe privacy legislation is a good thing.
It is very hard to explain to someone whose field of expertise lies outside tech the staggering depth of data that is routinely collected on them. Have you ever heard of ‘haptic data’? That is the information gathered simply when you touch your screen – how often, how firmly and exactly where. Ever noticed how, once you have paused over a skiing reel on Facebook, your next scroll mysteriously brings up another, or an advert for Carv (it is a ski geek thing)… that is Meta pairing your haptic data with the content it displays in an attempt to garner a conversion or engagement.
Your phone knows more about how you use your phone than you do.
Your data and your behaviour are incredibly valuable. Your haptic data on one device can identify you on another. Combine that with what information you actually volunteer and the deductions they can draw can far exceed what you intend – it is ripe for exploitation. Even anonymised profile data helps platforms better model the content that, in the end, someone will use to part you from your money, your sanity or your existing behavioural norms.
Obviously, this is not necessarily bad; I really do want to know how to ski better, and I thoroughly enjoy watching people who are far better than I will ever be. But this is powerful stuff. Far be it from me to accuse Meta (with its billions in fines) or X (with its 557 million users tied to Mr Musk’s regular outbursts) of being bad actors…
Done properly, privacy compliance allows you to demonstrate that you, good ship SME Ltd, are a good actor. If you can demonstrate that when customers trust you with their details, you will treat that data with respect, securing it properly and being utterly transparent, then you are displaying the marks of a business that actually values its community.
A secure, privacy-first website is one way the little guys can beat the heavyweights, simply by demonstrating true respect for their users.
Sermon over.
What’s Up Doc?
The Data (Use and Access) Act 2025 (DUAA) – the UK’s official post-Brexit update to the General Data Protection Regulation – is rolling out its core provisions. While the broader implementation spans from early to mid-2026, there is one critical milestone that is now literally days away.
By 19 June 2026, every organisation operating a website in the UK must legally have a formal, transparent procedure in place to handle data protection complaints from the public.
If your current strategy for data complaints is simply hoping nobody sends an email to your generic ‘info@’ inbox, you are about to find yourself on the wrong side of the law.
The 19 June Deadline: Formalising the Complaints Process
For years, handling a data query or complaint from a user was a relatively loose affair. If a visitor wanted to know how their data was being handled or wished to complain about a tracking script, businesses could largely deal with it on their own timeline.
That luxury disappears on 19 June. Under the new rules, your business must facilitate a structured complaints process. This means you are legally required to:
- Acknowledge any data protection complaint within 30 days of receipt.
- Ensure the entire process is completely transparent and accessible to the public.
- Facilitate a definitive outcome to the complaint without what the law terms “undue delay”.
This is not just an administrative chore for corporate giants. If you run a startup, a growing mid-market e-commerce store or a local service website, this applies to you. You need a clear, documented internal process to ensure that if a user raises a hand regarding their data, it is logged, acknowledged and resolved within the strict statutory windows.
The Teeth: Cookie Fines Just Got Severe-er
You might wonder whether the Information Commissioner’s Office (ICO) actually intends to enforce these shifting standards. To answer that, you only need to look at what happened earlier this year.
On 5 February 2026, the maximum fine for breaching UK cookie laws under the Privacy and Electronic Communications Regulations (PECR) underwent a staggering increase. Previously capped at a relatively modest £500,000, the maximum penalty has been raised to £17.5 million, or 4% of an organisation’s global annual turnover.
This change officially aligns cookie law penalties with the heavy-hitting fines of GDPR. The message from the regulators is deafeningly clear: treating cookie compliance and user data as an afterthought is now an existential financial risk for any business. If you are still deploying tracking pixels, analytics scripts or marketing cookies without explicit, active consent, you are operating under an ACME safe stuffed with £17.5 million of fines.
A Small Mercy: “Stop the Clock” on DSARs
It is not all bad news for website operators, however. The mid-2026 rollout of the Data (Use and Access) Act does introduce a highly pragmatic tool to help businesses defend themselves against weaponised or overly broad Data Subject Access Requests (DSARs).
As of February 2026, organisations are now legally permitted to “stop the clock” on the standard one-month response deadline for a DSAR. If a requester asks for an ambiguous or mountainously vast amount of information, you can pause the countdown while you wait for them to clarify exactly what data they require.
This is a massive relief for businesses that have previously been forced to waste huge hours compiling endless archives of data under the threat of an immovable statutory deadline.
The Shift in Cookie Consent
We no longer have to look ahead into the summer; the waiting is over. On 29 April 2026, the ICO actually published its highly anticipated final guidance on storage and access technologies, which covers cookies.
Historically, the rules around what constitutes an ‘essential’ cookie have been incredibly rigid. The new guidance officially clarifies new ‘low-risk’ exceptions – introduced by the Data (Use and Access) Act 2025 – where explicit user consent is no longer required. This includes the mechanics needed to adapt the appearance of a website to user preferences or tracking for purely statistical, service-improvement purposes.
The regulator has also delivered its definitive stance on the controversial ‘consent or pay’ models that have emerged across the web.
We’ll get a blog out about this, but you know these things need a run up.
So What Do You Actually Have to Do This Week?
To ensure your website stays on the right side of the ICO, make sure you can tick off these four essentials:
- Deploy a Formal Complaints Route: With the 19 June deadline hitting this week, you must have a clear, documented process to acknowledge any data complaint within 30 days and resolve it without undue delay.
- Audit Your Cookie Banners: Ensure your site actively blocks tracking pixels and marketing cookies before a user clicks accept. With the ICO’s final guidance now live and fines matching GDPR levels, a passive banner is a massive liability.
- Update Your Privacy Policy: Make sure your privacy policy accurately reflects how you handle data, specifies how users can request their information and clearly outlines your new complaints procedure.
- Secure Your Forms: Ensure your contact and marketing forms securely capture data, relay email safely and link directly to your privacy disclosures.
If you can tick all four, you rock! The good ship SME Ltd is in a fantastic position. If you are staring blankly at any of these points, you can either scramble to patch it together yourself – or you can ask Little Fire to sort it out properly for you. Give us a holler, and let’s make sure your digital presence is completely secure.At Little Fire Digital, we have spent years telling anyone who will listen that a website is far more than a visual design project. It is a productive, active extension of your business – and that means it is also a legal gateway.
We regularly review sites that look great on the surface but are an absolute compliance bomb-site. We’ve seen four in the last fortnight alone that make no attempt of any sort to achieve compliance despite collecting user data – both explicit and implicit.
Building a website properly means sweating these exact details. It means ensuring that your contact forms relay email securely, your user data is encrypted, your privacy policies are watertight and your cookie banners actually do what they claim to do.
The 19 June deadline is a sharp reminder that the internet is growing up, and the regulators are paying attention. Taking an hour this week to formalise how your business logs and responds to data complaints is not just about ticking a box for compliance – it is about protecting the business you have spent years building.
If you are worried that your current digital setup is exposing you to these new regulatory risks, or if you simply need some honest, straightforward internet advice on how to make your website fully compliant, look us up. Talk is free, and we are always here to help you do the work properly.