06/06/2026
If you run a UK business, pencil 19 June 2026 into the diary. That is when a small but important set of GDPR changes June 2026 take effect. Unlike the bigger reforms that arrived in February, this one places a direct duty on every organisation that handles personal data. It is not the sort of headline-grabbing rule that generates panic, but it is a duty you cannot opt out of, and you need a plan.The change comes from the Data (Use and Access) Act 2025 (the DUAA), the legislation that has been quietly reshaping UK data protection law throughout 2026. Most of the DUAA package landed on 5 February. The 19 June phase adds the last piece: a statutory complaints process for individuals who feel their data has been mishandled.
What is changing on 19 June 2026?
The Data Protection Act 2018 will gain a new section 164A, giving any individual a statutory right to complain about how their data has been handled directly to the organisation that holds it. Historically that path was informal.
New UK GDPR rules take effect on 19 June 2026. Learn what the DUAA complaints process means for your business and the simple steps to stay compliant.