If you’ve seen headlines warning that “GDPR is changing” this June, take a breath – it’s far smaller than the scary framing suggests. But there is a genuine change with a fixed deadline, and it’s a good excuse to do something most small businesses have been putting off: actually reviewing your privacy policy.
What’s changing on 19 June
From 19 June 2026, under Section 103 of the Data (Use and Access) Act 2025, every UK business that processes personal data must have a procedure for handling data protection complaints. It applies to everyone from sole traders to large corporations — there are no exemptions.
In practice, your procedure needs to cover: a way for people to complain, acknowledging every complaint within 30 days, investigating it without undue delay, keeping the person updated, and telling them the outcome clearly. For many small businesses this is reasonably light-touch — but how much you need to do depends on your business, so it’s worth checking what applies to you rather than assuming the minimum is enough.
The bit worth getting right: how people complain
You need to offer more than one way to raise a complaint. An electronic route — a simple web form or a dedicated email address — plus at least one non-electronic route, like a postal address or phone number, so people who can’t use online forms aren’t shut out. Many sites already display a phone or postal contact, so this is often partly done.
A note on the contact point: it doesn’t need to be a brand-new mailbox. A simple alias such as privacy@yourdomain.co.uk, forwarding to an inbox someone actually checks, does the job and is usually free. It’s worth pointing it somewhere appropriately private rather than a general shared inbox, because these messages can contain people’s personal data.
The bigger opportunity: review the whole thing
Most small businesses haven’t touched their privacy policy since their website first went live. But businesses change — new tools, new forms, a different email platform, new ways of collecting data. If your policy still describes the business you were three years ago, it’s out of date, and this deadline is the perfect nudge to fix it.
Where the responsibility sits
Here’s the important part: a privacy policy is a legal document about your business. Only you know exactly what data you collect, how you use it, who you share it with, and your lawful basis for doing so. That means responsibility for whether it’s legally correct sits with the business owner — it isn’t something a web designer can sign off on anyone’s behalf.
The good news is you don’t have to figure it out alone, and you can do this part directly yourself. The ICO — the UK’s regulator — offers a free privacy notice generator that walks you through creating or checking a tailored notice, with versions for different sectors. It works best when you already understand what data your business handles, so it’s a “fill in the blanks” tool rather than a magic button. A couple of things to know: it’s currently in beta (so double-check the output and revisit it once it’s finalised), and it isn’t designed for businesses that do automated decision-making or are required to have a Data Protection Officer — most small businesses aren’t, but worth a glance.
One important thing: the generator helps with the privacy policy itself, but the new complaints duty is covered by separate ICO guidance — “How to deal with data protection complaints” — which explains the process and the wording your privacy policy needs to include. The generator hasn’t been updated for the new duty yet (the ICO has flagged it’s under review), so check both. And if you already have a complaints process in place, you can adapt it rather than start from scratch.
(If it’s any comfort: even the ICO’s own privacy notice tool is still a work in progress — it’s currently in beta and openly under review for these changes. So if the rest of us are still catching up with this one, we’re in good company.)
One more clarification: a cookie policy and a privacy policy are two different things. A cookie tool handles cookie consent — the banner and tracking opt-ins — while the privacy policy (or notice) explains what personal data a business collects and why. The ICO’s generator says as much: it doesn’t cover cookies at all. Some businesses set their privacy policy up via a cookie tool’s inbuilt option, which is fit for purpose, but for the privacy policy specifically, going direct to the ICO’s own free generator is the cleaner route. If you’d prefer more robustness, solicitor-drafted templates exist for a modest cost; and if you hold sensitive data — health information, children’s data — a short conversation with a data protection specialist is the right call.
In short
Treat 19 June as a deadline to review, not panic. Check your privacy policy still reflects what your business actually does, make sure people have a clear way to raise a data protection complaint, and pick whichever route suits you for getting the wording right. How much you need to do depends on your business and the data you hold — so if you’re unsure, the ICO’s guidance is the place to check, and for anything sensitive a data protection specialist is worth a conversation.
Need a hand with your website?
Our maintenance plans include time and support each month — and someone in your corner when you need them.