Common Questions: What Changes on 19 June 2026, and How Do I Fix My Site?

If your website collects anything about the people who visit it, and almost every business website does, 19 June 2026 is a date for your calendar. From that day a new legal duty applies to every UK organisation that handles personal data. Plenty of small business sites are quietly falling short already, without their owners realising.

Here is what has changed, what it means for you, and how we can put it right with a one-off compliance audit.

What has actually changed

The Data (Use and Access) Act 2025, or DUAA, is the biggest change to UK data protection law since GDPR. It doesn’t tear up the rules you already know. It amends three of them together: the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations that govern cookies and marketing email.

Most of the Act came into force in February 2026. One duty was held back to 19 June 2026, and it is the one most businesses have done nothing about.

The 19 June duty in plain English

From that date, every organisation must have a proper process for people to complain about how their personal data is handled. A contact form buried three clicks deep no longer counts. You need to give people an accessible way to complain, including an electronic form they can fill in. You must acknowledge a complaint within 30 days, investigate it without delay, and tell the person the outcome. You also have to spell out their right to complain in your privacy notice.

If your site does not visibly offer that today, it will not meet the standard.

Why cookies are part of the same conversation

The same law tightened the rules on cookies and tracking, and this is where a lot of sites come unstuck. The regulator’s updated guidance now covers tracking pixels, scripts and device fingerprinting, not just classic cookies, and it expects your consent banner to genuinely control them.

In practice your analytics and marketing tags, Google Analytics, advertising pixels, embedded social feeds and the rest, should load and store nothing on a device until the visitor agrees. Plenty of sites look the part, with a tidy banner on top, while the tags fire away in the background regardless of what anyone clicks. That gap is exactly what is now being looked at.

There are a few welcome relaxations. Certain low-risk analytics cookies no longer need consent at all. But the exemptions are narrow and they vanish the moment a tag does double duty, such as analytics that also feeds your advertising. Working out which of your tags qualify means looking properly under the bonnet.

Why this matters now

This is not a paperwork job that can wait. The same reforms pushed up the penalties for getting cookies and electronic marketing wrong, and they now sit at GDPR level: up to £17.5 million or 4% of global turnover. The regulator has also said plainly that it will keep testing UK websites and acting on the ones that fall short.

For most small businesses the real danger is not a record fine. It is a complaint you can’t handle properly, an enquiry you are not ready for, or a customer who simply stops trusting you. All of it is avoidable with a little preparation.

How we can help

This is the behind-the-scenes work we do every day, and we have built a straightforward Website Compliance Audit to get your site ready for 19 June.

First, we audit your live website. We check what it actually does, which cookies and trackers fire, whether they are held back until consent, and whether you meet the new complaints and transparency rules. You get a clear, plain-English report of what works and what does not.

Second, we make the fixes. We correct your cookie and consent setup so tags only fire when they should, and we build a compliant data protection complaints page and form that meets the 30-day duty.

Third, you supply your wording. We are a web studio, not a law firm, so your privacy and complaints policies should come from you or your legal adviser. We will tell you exactly what they need to say and where they need to link, then put everything live. Your legal documents stay properly yours.

The audit and on-site work are charged as a single one-off fee, with no tie-in for you to sign. One job, done once and properly, and your site is ready for it.

Ready to get compliant?

19 June 2026 is a firm date, and the safest moment to act is before it arrives rather than after a complaint lands on your desk. If you would like us to look over your site, get in touch and we will book your compliance audit.

This article is general information about changes to UK data protection law and is not legal advice. For advice specific to your business, please consult a qualified data protection professional.