Quarterly BAS Due (July–September)
Form 1099-NEC & Contractor Payment Reporting Check
Why this matters.
Since 19 June 2026, every organisation that handles personal data — sole trader, charity, or large company — has been under a new legal duty introduced by the Data (Use and Access) Act 2025 to operate a proper process for data protection complaints. This is separate from responding to Subject Access Requests: it covers any complaint that someone’s personal data has been mishandled, whether that relates to marketing, retention, cookies and tracking, a security incident, or the lawful basis relied on for processing. Businesses must provide an accessible way for people to raise a complaint, acknowledge it within 30 days of receipt (starting the day after receipt, running even over weekends and bank holidays), make appropriate enquiries, keep the complainant updated, and provide an outcome without undue delay. The ICO has published dedicated guidance and has confirmed it expects organisations to be able to evidence this process if challenged.
For most small businesses this is a genuinely new operational requirement rather than a policy tweak — many have never had a defined internal route for data protection complaints, relying instead on a general “contact us” inbox with no tracking or deadline discipline. The ICO’s stated approach is that if someone can show they complained to a business and got no response, or the business cannot demonstrate proper handling, that itself becomes a point of regulatory concern — separate from whatever the underlying complaint was about. Getting this wrong risks ICO enforcement even where the original data protection issue was minor, because the complaints-handling failure becomes the primary breach. Any business without a documented complaints process, an owner for logging and diarising the 30-day acknowledgement, and a route to close out complaints should treat this as an urgent gap to fix.
