Britain’s small and medium-sized businesses have been put on notice. From 19 June 2026, exactly one month from today, every organisation that handles personal data will, by law, be required to operate a formal complaints process. Those that fail to prepare risk regulatory action, reputational damage and the slow drip of customer trust eroding away.

The new obligations flow from section 103 of the Data (Use and Access) Act 2025, the most significant reshaping of the UK’s data protection landscape since the post-Brexit settlement. And in a clear signal that the Information Commissioner’s Office is anxious to avoid a repeat of the GDPR scramble of 2018, deputy commissioner Emily Keaney has used the four-week countdown to issue a direct appeal to the smaller end of the market.

“There is still plenty of time to act, and the ICO is here to support you,” Ms Keaney said. “We know that smaller organisations are less likely to have formal complaints processes in place, and that is exactly why we have designed this guidance with you in mind.”

What the new law actually requires

For SME owners and finance directors who have not yet digested the detail, the statutory obligations are mercifully short. Under the new regime, every organisation must give individuals a clear and accessible route to raise a data protection complaint, whether by email, online form, telephone or post. Receipt of a complaint must be acknowledged within 30 days. Businesses must then, “without undue delay”, take appropriate steps to investigate, keep the complainant informed of progress, and communicate the outcome.

Crucially, there are no carve-outs. The rules apply to the corner shop with a customer mailing list just as much as to the FTSE 250 financial services firm. Privacy notices will also need updating to make clear that customers have a right to complain directly to the organisation before escalating to the regulator.

Why this matters more than it might look

On paper, the changes appear modest, a tweak to administrative housekeeping rather than the seismic shock that GDPR delivered seven years ago. But seasoned compliance professionals warn that complacency would be a mistake.

For the first time, individuals will have a statutory right to complain directly to the organisation handling their data, and to expect a structured response within a defined timeframe. That changes the calculus on everything from subject access requests to the handling of data breaches. The ICO has indicated that sectors generating the highest volume of complaints, healthcare, financial services, technology and retail, should expect particular scrutiny.

There is also a commercial logic at work. Resolving a grievance quickly and fairly tends to prevent it from metastasising into something more serious, whether a formal regulatory referral or a customer departure. As any SME operator who has watched a one-star Trustpilot review go viral can attest, the cost of getting the response wrong can dwarf the cost of getting the process right. The wider context is one of rising data risk, with the ICO already pressing the technology sector to embed privacy by design into AI products, a sign of how high the regulatory bar is climbing.

The ICO’s olive branch

The regulator’s tone this time is markedly different from the rather schoolmasterly approach that characterised the early GDPR rollout. The guidance, published in February following a public consultation that drew more than 85 responses, is studded with practical examples and worked-through scenarios pitched squarely at smaller firms without dedicated compliance teams.

“A data protection complaint can come from any customer at any time,” Ms Keaney noted. “Having a clear process means you can respond quickly, resolve issues fairly and protect the trust your customers place in you. We are not here to catch businesses out, we are here to help you get ready.”

That conciliatory framing should not, however, be mistaken for indefinite patience. Once the 19 June commencement date passes, the ICO will have the power to take enforcement action against organisations that fail to operate a compliant process, and the line between supportive regulator and active enforcer can move quickly.

A four-week action list

For business owners still unsure where to begin, the practical steps are reasonably straightforward. Decide who inside the business will own the complaints process and ensure they have the authority to investigate and respond. Build a simple, visible route for customers to raise complaints — usually a dedicated email address or web form, signposted in the privacy notice. Document the workflow, including how the 30-day acknowledgement deadline will be met. Train any customer-facing staff on what to do if a complaint lands in their inbox.

Owners who already operate under data protection frameworks will recognise much of this from existing good practice. For a refresher on the broader compliance landscape, our complete guide to GDPR compliance in the UK sets out the foundations, while our explainer on the difference between data controllers and processors is worth bookmarking for any business that shares customer data with third parties.

The bottom line

For Britain’s 5.5 million SMEs, the message from regulators is clear: 19 June is not a target, it is a deadline. The four weeks ahead are not an invitation to delay, but a window to prepare. Done well, the new complaints process is a modest piece of administrative plumbing that can quietly strengthen customer relationships. Done badly, or not at all, it is a regulatory exposure that few small businesses can afford to carry.

The ICO has, unusually, all but rolled out a welcome mat. The smart move for SME owners is to walk through the door before someone else knocks.

Read more:
ICO Warns SMEs: one month to comply with new Data Complaints Law

Mike Ashley’s retail empire has scored a notable courtroom victory after the Court of Appeal threw out a substantial damages award handed down in a protracted trademark infringement dispute, sparing the FTSE-listed group what could have proved a punishing financial blow.

The ruling brings to a head a long-running tussle between the Shirebrook-based discount sports chain, rebranded as Frasers Group in 2019, and Lifestyle Equities, the company that owns and licenses the Beverly Hills Polo Club marque. Lifestyle Equities had alleged that Ashley’s group infringed its trademark by flogging goods under the rival ‘Santa Monica Polo Club’ label, a claim it first lodged back in 2018.

Frasers had lost the underlying infringement case seven years ago but mounted a fresh challenge against the scale of damages it was ordered to stump up. At an appeal hearing in April, the retailer’s lawyers argued that the bill should be slashed because the third-party companies trading under the Beverly Hills Polo Club name, and on whose behalf Lifestyle Equities was attempting to recover losses, had never been officially registered as licensees in the United Kingdom.

The Court of Appeal duly sided with the high street giant, ruling that it was “too late” for Lifestyle Equities to retrospectively register the licences in question. With the original claim dating back to 2018 and the licensing arrangements stretching back nearly a decade, the court concluded that the additional claims “appear to be well out of time” and that allowing them through would amount to an “unprincipled windfall” for businesses that had not properly placed themselves on the public register.

Counsel for Frasers warned during the appeal that permitting such claims to succeed would expose accused infringers to ambush litigation, leaving defendants “suddenly confronted with a Trojan Horse full of licensees claiming damages” of whose existence they had no prior knowledge. Without strict adherence to public registration, the retailer’s legal team argued, the regime risked becoming “a charter of unjust enrichment”, allowing trademark owners to scoop up compensation for unregistered partners alongside their own losses.

The judgment represents a material win for Frasers, which has shrugged off a potentially eye-watering damages bill that, had it stood, would have set an awkward precedent for the wider retail sector. The decision is likely to be studied closely by intellectual property lawyers and brand owners alike, given the implications for how licensing arrangements must be formally documented to be enforceable in the British courts.

The legal win follows news first reported by City AM that the magic circle-adjacent law firm RPC has lost one of its highest-billing partners, Jeremy Drew, who represents Ashley personally, to Taylor Wessing.

The trademark victory comes hard on the heels of an extraordinary admission by Ashley, the man who founded Sports Direct in his native Burnham in 1982 and ran it as chief executive until handing the reins to son-in-law Michael Murray in 2022.

The 61-year-old billionaire has confirmed publicly for the first time that he engineered the downfall of his most prominent retail adversary, the former JD Sports executive chairman Peter Cowgill.

Cowgill stepped down from the FTSE 100 trainer chain in 2022 in the wake of a Competition and Markets Authority probe, triggered after leaked footage emerged of him in a clandestine car park meeting with Footasylum chief executive Barry Brown. The pair had been expressly barred from exchanging commercially sensitive information while JD Sports was attempting to acquire Footasylum, and the leaked footage led the CMA to impose fines of nearly £5m on the two businesses.

In an interview with the Financial Times last weekend, Ashley conceded that the footage had been obtained by one of his own employees and said he was “not hiding from the fact” that he was the architect of Cowgill’s removal, a candid acknowledgement that lifts the lid on one of the more colourful boardroom feuds in recent British retail history.

Read more:
Ashley’s Frasers group dodges hefty damages bill in trademark appeal victory

For several summers, I have taught drone photography in Iceland’s highlands under permits issued by the country’s nature conservation agency. I applied on time, followed every condition, and never received a complaint from a ranger, another visitor, or the agency itself.

[Read More]

Insta360 has countersued DJI for what it asserts are violations of five utility patents covering technology used in gimbal and 360-degree cameras. Insta360 claims these technologies are incorporated into several major DJI products, including the Osmo Pocket, Ronin/RS, Osmo Mobile, and Osmo 360.

[Read More]