HR Update: New Data Protection Rules: What HR needs to do

Key changes under the Data (Use and Access) Act 2025, effective 19^th June 2026

As if employers did not have enough to worry about with all of the new employment law changes, they need to take into account new data protection duties as well.

New legislation means that from 19^th June 2026, employers must have a formal process for handling employees' data protection complaints - and must update their privacy notices to reflect this. This is not just good practice; it is now a legal requirement.

What has changed?

Employees have always been able to complain to the Information Commissioner's Office (ICO) if they believe their employer has mishandled their personal data. What is new is that employers must now have their own formal complaints process in place, with clear timelines and record-keeping requirements. The aim is to resolve concerns internally before they reach the regulator.

The key obligations are straightforward: acknowledge any data protection complaint within 30 days, investigate it properly, and tell the employee what you have found and what, if anything, you are doing about it.

What should HR do?

• Update your privacy notice to tell employees they have the right to raise a data protection concern with you directly, and explain how to do it.

• Set up a clear way for employees to submit complaints - an email address or simple form is sufficient for most employers.

• Make sure someone owns the process: complaints need to be logged, acknowledged within 30 days, investigated, and responded to.

• Brief your Management/HR team on what a data protection complaint looks like - it does not need to use formal language, and could arrive by email, letter or even in conversation.

• Keep records of complaints received and how they were handled.

Is this different from a Data Subject Access Request?

Yes - a Data Subject Access Request (DSAR) is when an employee asks to see what personal data you hold about them. A data protection complaint is when they say you have done something wrong with their data - for example, shared it without authority, kept it longer than you should, or failed to keep it secure. The two can overlap, but they are handled differently and have different timescales.

Do we need specialist help?

For most employers, the practical steps are manageable without specialist legal input. If you do not already have a privacy notice, or your existing one is out of date, that is the place to start. For anything more complex - such as a complaint that involves a potential data breach - it is worth taking advice.

The guidance provided in this article is just that - guidance. Before taking any action, make sure that you know what you are doing, or call an expert for specific advice.