Data protection complaints and cookies: what changed for small businesses in 2026

If your business holds customer names, email addresses or order histories, a change in data protection law that came fully into force on 19 June 2026 applies to you. There is no exemption for small firms, sole traders or startups. The good news is that the practical work is modest, and you can finish most of it in an afternoon.

The change comes from the Data (Use and Access) Act 2025. Its provisions were phased in over twelve months, and the Information Commissioner's Office (ICO) has said that the final pieces arrived on 19 June 2026. This article covers the two that matter most to a small business with a website: the new duty to handle data protection complaints, and the relaxed rules on analytics cookies.

The new duty: a way for people to complain to you

From 19 June 2026, every organisation that handles personal data must give people a clear way to raise a data protection complaint directly with it. According to the ICO, you must:

• Make it possible for people to complain to you
• Acknowledge each complaint within 30 days of receiving it
• Take appropriate steps to investigate and respond without undue delay
• Keep the person informed about progress
• Tell them the outcome

Note that the 30 days applies to acknowledging the complaint, not to resolving it. Resolving it must happen without undue delay, which in practice means promptly, not eventually.

The ICO published its final guidance for organisations on 12 February 2026, and it sets out what organisations must, should and could do. It also says the guidance reflects good practice even before the rules took effect. At the point the rules began, the ICO's Deputy Commissioner, Emily Keaney, said this is about good data protection becoming business as usual, and that the regulator's role is to help businesses, particularly smaller ones, adjust rather than to punish them.

What counts as a data protection complaint

A data protection complaint is not the same as a normal customer service complaint. It is a worry about how you have handled someone's personal information. The ICO's published examples include subject access requests that were not answered properly, inaccurate data, and unwanted marketing. A customer who says "you keep emailing me after I unsubscribed" is raising a data protection complaint, even if they do not use those words. That is why the staff who read your inbox need to know what to look for.

What to do this week

You do not need a legal department or special software. One practical guide for small firms suggests that for a startup, the process "could be as simple as providing and regularly monitoring an email address." A sensible set of steps looks like this:

• Choose a channel. A dedicated email address, a contact form, a phone number or a postal address will all work. Pick one you actually check.
• Update your privacy notice. Tell customers and staff that they can complain to you, how to do it, and that they can also complain to the ICO.
• Name an owner. Decide who deals with complaints, and make sure anyone who reads the shared inbox knows how to spot one.
• Write a short procedure. Acknowledge quickly, investigate, update the person, and give a final answer. A page is plenty.
• Keep records. Save the complaint, your correspondence, your notes and the outcome. The ICO guidance recommends complaints are properly recorded and that you review outcomes to spot problems you could prevent.

The record keeping is worth the effort for a second reason. If a complaint ever reaches the ICO, being able to show a simple, followed process is far better than having nothing to show.

Analytics cookies: a genuine relaxation, with conditions

The same Act changed the Privacy and Electronic Communications Regulations (PECR), which govern cookies. Previously, nearly every cookie other than the strictly necessary ones needed consent first. The ICO published updated guidance on storage and access technologies on 29 April 2026. PECR now has new exceptions to the consent requirement, including one for statistical purposes and one for adapting how a service appears to a user's preferences.

In plain terms, you may be able to use cookies for basic analytics without a consent banner, as long as:

• The sole purpose is to gather statistics about how your website is used, so that you can improve it
• The information is aggregate, about how the site is used rather than who is using it
• You tell visitors what you are doing
• You give them a simple and free way to object, and you stop immediately if they do
• Any third party analytics provider acts only as your processor, and the data is used only to improve your service

The exception does not cover everything. It does not extend to tracking individual users, advertising measurement, building profiles, personalising content around known interests, or tracking across different sites and apps. Advertising and marketing cookies, such as the pixels used to retarget visitors, still need prior consent.

What this means for your website

Many small business sites run a standard analytics tool and a cookie banner that was bolted on years ago. It is worth a short review:

• List every cookie and tracking script on your site. Your developer or a browser's developer tools can show you.
• Sort them into strictly necessary, simple statistics, and everything else, such as advertising pixels and social media embeds.
• If your analytics tool is configured only for aggregate statistics, you may be able to treat it under the new exception, but only if you provide the notice and a working opt-out.
• If any tool also feeds advertising or builds visitor profiles, that tool still needs consent before it loads.

Be careful here. Check whether your analytics tool has any advertising or profiling features enabled, because those would take it outside the exception. Check the settings, not just the product name. If you are unsure, keep your current consent banner until you have confirmed the configuration. A banner that is stricter than necessary is a smaller risk than a tracker that fires without consent when it should not.

Will the ICO fine small businesses?

The ICO's own advice to small organisations is that fines are not suitable for every breach, and that its main approach is helping businesses make changes and improvements to comply. It also notes that most of the UK's small and medium sized businesses are working hard to comply despite limited resources. At the same time, the ICO publishes enforcement action against organisations of all sizes, including small businesses and sole traders. So the sensible reading is that the ICO wants you to have a working process, and not that it can be ignored.

The ICO also points to research showing that over two thirds of businesses either lack awareness of this law or misunderstand whether it applies to them. If you read this far, you are already ahead of most.

A quick checklist

• Set up and monitor a complaints email address or form
• Add complaint wording to your privacy notice
• Appoint one person to own complaints and brief anyone reading the inbox
• Write a one page procedure covering the 30 day acknowledgement
• Audit your cookies and analytics settings
• Make sure any statistics-only cookies have a visible notice and a simple opt-out

If your website needs its cookie handling or privacy pages reworking, our web design team can help. For the legal detail specific to your business, take advice from a data protection professional or use the ICO's free resources for small organisations.