What new data protection rules come into force in June 2026?

You'll likely already be aware of what GDPR is - the set of laws around data protection, and your responsibilities when you're storing personal data.

As a freelancer, you have obligations and legal duties to ensure that information you store on people, including your clients, is held responsibly.

But you might be less aware of recent changes to the law which impact you as a business owner, and there are a new set of rules which come into force on June 19th 2026, which you'll want to know about.

What's changing?

The Data (Use and Access) Act 2025 is the UK's biggest update to data protection law since we kept the EU GDPR rules after Brexit.

The DUAA doesn't replace GDPR, but adds a number of changes, some that offer more flexibility, some with stricter rules.

Whilst this post doesn't go into the detail of GDPR and DUAA or your obligations under these laws, a portion of DUAA comes into force on June 19th, 2026.

From June 19th, 2026 - you need to:

• give people a way of making data protection complaints to you;
• acknowledge receipt of complaints within 30 days of receiving them;
• without undue delay, take appropriate steps to respond to complaints, including making appropriate enquiries, and keep people informed; and
• without undue delay, tell people the outcome of their complaints

You must have a process for handling data protection complaints within your organisation - there are no exemptions to this.

What does this mean for you as a freelancer?

If you're collecting personal data (anything that identifies an individual - that includes things like emails from your clients, if you run a newsletter or sign up form on a website, or customer information when they buy something from you), you need to be following the rules.

There's a useful tool to check if data protection laws apply to your business on the ICO website.

These changes on June 19th are likely to require you to update any published policies (i.e. on your website or similar), and develop an updated internal process for handling any data protection complaints.

Again, ICO have some simple guides on how to do this

What do I need to do?

The ICO offer these suggestions on how to prepare for the change:

• Familiarise yourselves with the changes that the DUAA makes to data protection law using their guidance.
• Start thinking about how you can help people to make complaints.
• Review the changes that support innovation and make things easier and consider whether you want to take the opportunity to do anything differently or streamline your processes.