The New Data Law Is Here. Is Your Business Ready?

There is a new law that came into effect in the UK in June 2025, and a lot of small business owners have not heard of it yet. It is called the Data Use and Access Act, and it updates the rules around how businesses handle personal data, including how they use AI tools.

I know. Another thing to think about. But this one is worth knowing, because it affects most businesses, including sole traders and small teams, and the ICO (the Information Commissioner's Office) is the regulator that will come knocking if things go wrong.

The good news is that the ICO has made it straightforward to find out what you need to do. You do not need a lawyer or a compliance consultant to get started. You just need to know where to look.

What Has Changed?

The Data Use and Access Act builds on the existing UK GDPR rules most businesses already know about. The key changes that affect small businesses include a new requirement to have a clear data protection complaints process in place. That means if a client or customer raises a concern about how you have handled their data, you need a documented process for dealing with it, not just a vague idea of what you might do.

There are also updates to the rules around AI and automated decision-making, which matter if you use AI tools as part of how you work. And there are changes to what counts as a legitimate reason to process someone's personal data.

None of this needs to be complicated. But it does need to be documented and in place.

You only have to look at what happened to Marks and Spencer in 2025 to see why this matters. A ransomware attack came in through a third party supplier, starting with phishing and stolen login details that should have been updated but were not. Customer names, addresses and order histories were exposed. M&S is a household name with serious resources behind it, and it still happened. A small business cannot afford to assume "it will not happen to me."

The fines are real too. Under UK GDPR the ICO can fine a business up to £17.5 million or 4% of global turnover, whichever is higher. In the first half of 2025 alone, ICO fines totalled £5.6 million across UK businesses. Most of those cases were not big dramatic hacks, they were ordinary failures: no proper process, no documentation, no one checking the basics were in place.

Whether you're in a big office or a small one, it matters.

Where to Go on the ICO Website

The ICO has a dedicated page for the Data Use and Access Act with plain-English guidance on what it means for your business. This is the best place to start:

ico.org.uk: Data Use and Access Act 2025

They also have a practical AI and data protection risk toolkit you can download as an Excel file, which walks you through the risks of using AI in your business and helps you assess whether you have the right safeguards in place:

ico.org.uk: AI and Data Protection Risk Toolkit

What Should You Actually Do?

If you are a small business owner using AI tools as part of your day to day work, here is where to start. Check whether you have a written data protection complaints process. Make sure your privacy policy mentions the AI tools you use and why. Review whether the AI tools you rely on are storing or sharing client data in ways you have not accounted for. If you have not updated your privacy policy or terms since the new law came in, now is a good time to do that.

I went through this process myself earlier this year as part of my own compliance review. It took time and focus, but it is absolutely doable, and it gives you and your clients real peace of mind.

This is something I take seriously, not just for my own business, but for the businesses I work for too. When you bring someone in to help with your admin, your emails or your social media, their compliance becomes part of your risk as well. It is one more reason to know exactly who you are trusting with your data.

If you would like some help working through it, I can point you in the right direction, help you put it together and get it added to your website. To find out more, take a look at my services page.