Most business owners and key decision-makers I speak to are in the same position: AI tools are already in use across the business (marketing, customer service, HR, analytics, and finance), but governance hasn’t kept pace. That's understandable. Businesses move fast, but regulation moves more slowly. And yet, in 2026, the direction of travel is clear: data protection is becoming more operational (especially around complaints and access requests), and AI governance is moving from “nice to have” to “expected”.
This is not to be feared, as you do not need a complex corporate compliance programme to get this right. What you need is a simple, documented playbook that fits your size, risk profile, and technology use.
In this article, I'll focus on the changes under the Data (Use and Access) Act 2025 (“DUAA”) and make recommendations on what SMEs can do to stay compliant while still innovating confidently. I’ve set out the key 2026 dates to watch, what the DUAA changes in practice, and a ‘minimum viable’ action plan you can implement quickly.
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. The government published a commencement plan confirming that its provisions will be brought into force in stages via commencement regulations.
Government guidance explains that data protection changes will be commenced over time after Royal Assent, with precise dates set out in regulations rather than in the Act itself.
The practical implication is that 2026 is not about reacting to a single “go live” date. It is about tracking when key measures come into effect and ensuring your day-to-day processes are ready in advance.
Government commencement planning indicates the measures requiring controllers to establish complaint-handling processes are expected to commence around 12 months after Royal Assent (i.e. around June 2026, subject to commencement regulations).
The ICO’s complaints guidance is insistent that organisations must have a process for handling data protection complaints. At a minimum, SMEs should be able to:
This is one of the clearest high-impact changes for SME businesses.
DUAA also contains a specific AI/copyright “watch this space” obligation: the government must publish an economic impact assessment and a report on the use of copyright works in the development of AI systems before 18 March 2026.
Even if you are not training AI models yourself, this date is worth tracking. It is likely to influence the UK’s future approach to AI development, transparency and licensing.
DUAA does not replace UK GDPR. It amends the UK GDPR, the Data Protection Act 2018 and PECR. The policy intent is to reduce friction in certain areas while maintaining core protections. In practice, businesses tend to feel the impact in a small number of very specific, operational places.
If you only do four things this year, be sure it's the following:
In my experience, SMEs already handle complaints, but often informally (a customer emails someone, a manager replies, and it’s treated as customer service rather than a legal process). The DUAA shifts this. The ICO expects organisations to have an internal process for handling data protection complaints.
You need a visible route for reporting data-handling issues, and a repeatable internal process for receiving, investigating, responding to, and documenting outcomes.
This is one of the easiest 2026 projects to get right, and it pays dividends in reduced escalation to the ICO.
Subject Access Requests (SARs) are disruptive largely because they arrive unexpectedly and often land with people who do not recognise them as SARs.
The ICO has updated its SAR guidance to reflect DUAA changes (while noting that some changes are not yet in force). Two practical points are particularly important:
For most SMEs, the pain point is not the legal test; it’s knowing where data lives (email, collaboration tools, shared drives, CRM, HR systems) and getting the right people to search quickly.
The risk here is less about the law and more about the workflow. I recommend doing two things:
Train your frontline teams (reception, sales, HR, customer support) to recognise SAR wording, because there are no formal requirements and requests can come in multiple formats.
Create a one-page SAR playbook. Be sure to cover who receives it, who logs it, who searches systems, how you verify identity, when you seek clarification, and who signs off the response.
DUAA takes a more permissive approach to decisions based solely on automated processing, including those with legal or similarly significant effects (for example, recruitment screening, credit decisions, pricing eligibility or service access).
However, that permission is conditional. Government guidance emphasises that organisations must implement safeguards, including:
Meaningful human involvement in reconsideration is not optional. If you use AI tools for HR screening, risk scoring, fraud decisions, or customer profiling, your safest approach is:
Document the decision chain (what is automated vs what is reviewed).
Ensure a human can override.
Make sure you can explain decisions in plain language if challenged.
DUAA aims to simplify some areas that SMEs regularly find burdensome.
Two examples to watch:
DUAA introduces a list of recognised legitimate interests intended to give more certainty for specific purposes, but SMEs should follow commencement and ICO guidance closely before changing their approach.
Government guidance indicates the Act allows some uses without explicit consent in certain low-risk situations. Treat this as guidance-led and evidence-based: document why you think a cookie falls into a permitted category.
This is the straightforward, step-by-step plan I use with clients to quickly get AI and data governance into a safe, workable shape, without overcomplicating it or creating unnecessary paperwork.
Create a simple document that gives you a clear view of your AI and data landscape: what personal data you hold (customers, employees, leads/marketing lists), where it lives (CRM, HR system, email marketing tool, shared drives), and which AI tools touch it (chatbots, meeting transcription, analytics, recruitment tools). You can do this easily in Excel, or in any platform you already use. Create a table and fill it:
These are the two day-to-day playbooks your team needs so everyone handles requests consistently, and on time.
SARs (Subject Access Requests)
A SAR playbook is your step-by-step process for when someone asks for a copy of their personal data. It should set out:
Complaints
A complaints playbook explains what happens when someone raises a concern about your service or how you’ve handled their data. It should cover:
Before you roll out a tool, verify:
Start with the ICO’s AI and Data Protection guidance and align your approach to it.
Plan conservatively: