GDPR is changing in 2026. The good news? Most of the changes haven’t happened yet, so you’ve got time to get ready.
The Data Use and Access Act became law on 19 June 2025, and the changes are rolling out gradually throughout this year. Even better news – on 19 December 2025, the EU said the UK can keep sharing data freely with European countries until 2031. If you work with European clients or suppliers, that’s a big relief.
Feeling worried about all the compliance paperwork? Don’t be. These aren’t massive changes – they’re updates that actually make some things clearer and easier. Let’s break down what you need to know.
What’s happening and when
Think of the Data Use and Access Act like an update to your phone. It doesn’t replace GDPR – it just makes some improvements.
Here’s the timeline:
August 2025: A few technical changes came into effect
Late 2025 / Early 2026: The main updates are expected to start, some already have
Around June 2026: New rules about handling complaints should kick in
All through 2026: The ICO (the data protection watchdog) will publish guidance as each change happens
The key point? Most changes aren’t live yet. You’re not playing catch-up – you’re getting ready ahead of time.
About that EU data sharing: On 19 December 2025, the EU renewed its decision that the UK has good enough data protection standards. This means you can keep sharing data with EU countries until 2031 without extra paperwork. Huge win for businesses working across borders.
Real example: If you’re a construction company in Brighton working with a Dutch architect, you can still share plans and client details as normal. Nothing complicated needed.
If you handle data that crosses borders, ERGOS can make sure your systems stay compliant.
Seven things that are changing (and what you need to do)
These changes are coming in 2026. Some are here already, others are on their way. Here’s what matters for your business.
1. “Recognised legitimate interests” – a simpler legal reason for using data
When it’s happening: Not yet – probably early 2026
Right now, when you use “legitimate interests” as your reason for processing data, you have to do a full assessment. Soon, certain activities won’t need that assessment at all. These include things like emergency response, keeping people safe, protecting your IT systems, and preventing crime.
Real example: Let’s say you’re a law firm in Haywards Heath and you spot dodgy financial transactions in a client’s accounts. Once this change happens, you can report it to the National Crime Agency without doing a long assessment first. Crime prevention will automatically count as a legitimate interest.
What to do:
- Look at where you currently use legitimate interests
- Work out which activities will fall under this simpler category
- Get ready to update your privacy notices
ERGOS IT Compliance services can help you figure this out.
2. You’ll need a proper way for people to complain
When it’s happening: Probably around June 2026
Soon, you’ll need to provide a clear way for people to complain about how you use their data. You’ll have to respond within 30 days and investigate properly.
What to do now:
- Set up a complaints email or web form
- Write a simple process for handling complaints
- Train your team
- Update your privacy notice to tell people how to complain
Need help setting this up? ERGOS IT Support can sort the technical side for you.
3. Using AI and automation gets easier
When it’s happening: Early to mid-2026
Currently, if your systems make automated decisions about people (like approving loans or filtering job applications), you’re quite limited in how you can do it. The new rules relax this – you’ll have more flexibility as long as you have proper safeguards.
Real example: An accountancy firm in Hastings uses software that automatically sorts expenses into categories. Once this change kicks in, they won’t need explicit permission from every client. They just need proper safeguards like human reviews and a way for people to challenge decisions.
What to do:
- List any systems that make automated decisions
- Make sure you have safeguards (human oversight, appeals process)
- Get ready to update your privacy notices
Thinking about using AI? ERGOS AI for Business services can help you do it properly.
4. Cookie rules with massive fines attached
Tell people what you store and why. Get clear, active opt‑in before any non‑essential tracking.
When it’s happening: The fine increase isn’t in force yet – but don’t wait
The maximum fine for breaking cookie rules could jump from £500,000 to £17.5 million (or 4% of your turnover, whichever is bigger). That matches GDPR fines. Even though this increase hasn’t happened yet, the ICO is already cracking down on cookie compliance.
What to do right now:
- Check your website’s cookie banner – is it as easy to reject cookies as accept them?
- Make sure tracking cookies don’t load before someone agrees
- Fix your marketing emails to make sure people actually opted in
- Keep records of everything
The ICO has been checking the UK’s biggest websites for cookie problems. Don’t think you’re too small to matter – fix this now.
5. Extra protection for children online
When it’s happening: Some rules are already here, more coming in 2026
If children might use your service, you need to think about their needs when handling their data.
Who this affects: Sports clubs, after-school clubs, tutoring businesses, gaming companies – anyone kids might interact with online.
What to do:
- Ask yourself: could under-18s use our service?
- If yes, make sure you’re not collecting more information than needed
- Write your privacy information so kids can understand it
The ICO’s Age Appropriate Design Code explains this in detail.
6. Moving data internationally – clearer rules
When it’s happening: Guidance is already out, some rule changes coming in 2026
The ICO has made it simpler to understand when you need extra safeguards for international data transfers. There’s now a three-step test:
- Does UK GDPR apply to what you’re doing?
- Are you sending data outside the UK?
- Is the country you’re sending it to on the approved list?
What to do:
- Map where your data goes (which countries, which companies)
- For countries not on the approved list, make sure you have proper contracts in place
- Check your agreements with cloud providers
For tricky international situations, ERGOS Cloud Solutions makes sure everything’s set up right.
7. Research gets more flexibility
When it’s happening: 2026
There will be broader exemptions for using personal data in scientific research. Unless you’re doing research, you can skip this one.
How to get ready through 2026
Most changes haven’t happened yet, which means now is the perfect time to prepare. Here’s a simple plan.
January to March 2026: Work out what affects you
Get your key people together for a couple of hours. You need to map out what data you handle.
Questions to answer:
- What personal information do we collect?
- Where does it come from?
- What do we do with it?
- Where does it go?
- Which of the new changes will affect us most?
Make a simple spreadsheet. Nothing fancy needed – just get it written down. Then keep an eye on the ICO website to see when each change actually happens.
April to June 2026: Get your systems ready
As the rules start coming in, you’ll want to have everything prepared:
- Write updated privacy notices (don’t publish them yet – wait until the rules are actually in force)
- Design your complaints system
- Check and improve your website’s cookie banner
- Make sure your automated systems have proper checks and balances
- Create training materials for your team
July to September 2026: Go live and train everyone
Once the rules are actually in effect:
- Publish your updated privacy notices
- Switch on your complaints handling system
- Train your staff (everyone who handles data needs to know what’s changed)
- Update your records
- Test everything works
Important: Don’t panic. If you were already following GDPR in 2018, you’re not starting from scratch. You’re just adding a few updates to what you’re already doing.
Mistakes we’re seeing (and how to avoid them)
Mistake 1: Waiting until the last minute
The ICO (the data protection watchdog) is already checking businesses, especially their cookie banners. Even though the big fine increases haven’t happened yet, you don’t want to be caught out. Start preparing now.
Mistake 2: Thinking you’re too small to worry about
Wrong. GDPR applies to all businesses, big and small. Yes, the ICO is reasonable – they won’t expect a 10-person firm to have the same systems as a bank. But you still need the basics: proper privacy notices, correct consent, and secure data handling.
Mistake 3: Thinking everything’s already changed
This is causing real confusion. Lots of businesses think the new rules are already here. They’re not – most are coming throughout 2026. Don’t implement changes before they’re actually required, but don’t ignore them either. Prepare now, implement when ready.
Mistake 4: Doing everything yourself when you need help
Some stuff you can handle yourself – basic privacy notices, simple cookie banners. But complex things like international data transfers, AI systems, or dealing with ICO investigations? Get expert help.
Contact ERGOS to work out where you need support and where you’re fine on your own.
What this means for different types of Sussex businesses
Finance and accountancy firms: You handle really sensitive stuff – tax info, financial records, business secrets. Focus on: keeping client data confidential, automated fraud detection systems, moving data internationally, and the new crime prevention rules. Coveney Nicholls, a Sussex accountancy firm, worked with us to update their systems whilst keeping everything secure.
Legal firms: The new “recognised legitimate interests” rules are great for you. Reporting suspicious activity and crime prevention will become simpler. Just make sure you understand how data protection rights work alongside legal professional privilege – especially when someone asks to see their data.
Construction businesses: You probably handle more personal data than you realise – staff records across different sites, subcontractor details, site photos, health and safety records. Make sure your site cameras have proper signs and you’re not keeping footage forever.
Need to connect multiple sites securely? ERGOS Network Services can sort that out whilst keeping you compliant.
How we help Sussex businesses stay compliant
You didn’t start your business to become a data protection expert. You started it to help clients, build things, or provide services. That’s where we come in.
We provide the tech that makes compliance manageable:
What we do:
- Set up secure cloud storage with proper access controls
- Build systems that automatically keep audit trails
- Provide encrypted email and file sharing
- Protect your network from breaches
Real example: One of our customers handles incredibly sensitive patient data. We made sure their expensive medical systems worked perfectly whilst meeting strict compliance rules. The result? Technology that helps with compliance instead of making it harder.
Our approach:
- We talk in plain English, not tech jargon
- We match solutions to your business size (we won’t sell a 10-person firm enterprise-level systems they don’t need)
- We’re here when you need us (95%+ customer satisfaction)
Services that help with compliance:
- ERGOS Managed IT Services – reliable infrastructure for secure data handling
- IT Compliance services – help staying compliant and resilient
- Cybersecurity services – protect your data and reputation
What to expect after 2026
What the ICO will focus on: Cookie compliance, AI and automated decisions, protecting children online, and making sure businesses are transparent about data use.
Future changes: The UK-EU data sharing agreement lasts until 2031, with a check-in in 2029. There might be more UK GDPR updates if Europe makes changes.
How to future-proof your business:
- Build flexible systems that can adapt when rules change
- Subscribe to ICO updates
- Check your compliance once a year
- Work with IT partners who keep up with the latest requirements
What to do next
This week
- Read through the seven changes and note which ones affect you
- Test your website’s cookie banner (open it in an incognito/private window)
- Sign up for ICO updates so you know when rules come in
- Book a free cybersecurity check with ERGOS
In the next few months (Q1-Q2 2026)
- Design your complaints system
- Write updated privacy notices (keep them in draft until the rules are actually in force)
- Document what you’re doing to prepare
- Contact ERGOS about compliance help
Ongoing
- Watch for ICO announcements about when each change happens
- Prepare training for your team
- Check your compliance every three months (just 30 minutes)
- Subscribe to ERGOS blog for updates
Your questions answered
Do I have to redo all my GDPR work from 2018?
No way. If you were compliant back then, you’re just updating things, not starting over. Focus on getting ready for the new bits: complaints handling, cookie compliance, and working out which activities count as “recognised legitimate interests.” The basic principles of GDPR (be transparent, be fair, only collect what you need, keep it secure) haven’t changed.
What’s the biggest risk right now?
Cookie compliance. The massive fine increase (up to £17.5 million) isn’t in force yet, but the ICO is already checking websites under current rules (where the fine can be £500,000). They’ve already found problems on loads of sites.
Check yours today: Is it as easy to reject cookies as accept them? Do tracking cookies load before someone agrees? Can people change their mind easily?
When will these changes actually happen?
Gradually through 2026. Some technical stuff happened in August 2025. The main changes (like recognised legitimate interests and automated decision rules) are expected early to mid-2026. Complaints handling is probably around June 2026. The ICO publishes guidance as each bit comes in. Keep checking their website.
Do I need a Data Protection Officer?
Most small and medium businesses don’t. You need one if you’re a public body, or if your main business involves large-scale monitoring of people or processing sensitive data at scale. A 15-person accountancy firm or 50-person construction company? Probably not. But someone in your business should be in charge of data protection.
Can I still share data with Europe?
Yes! The EU renewed the UK’s “adequacy decision” on 19 December 2025. It’s valid until 2031. This means data can flow freely between the UK and EU without extra paperwork. Brilliant news if you work with European clients, suppliers, or use European software.
For other countries (like the US, unless they’re covered by the Data Privacy Framework), you’ll need Standard Contractual Clauses in your agreements.
What happens when someone complains about my data handling?
Once the complaints rules come in (probably June 2026), you’ll have 30 days to acknowledge the complaint, and you must investigate quickly.
Start preparing now:
- Set up a dedicated email (like dataprotection@yourcompany.co.uk)
- Write template responses
- Work out who will handle complaints
- Document the process
Think of it like your normal customer complaints system – just specifically for data protection.
Will I get fined if I don’t have a complaints process?
Once it’s required, yes – potentially. The ICO can issue warnings and fines if you don’t follow GDPR rules. Not having a complaints system breaks the transparency and accountability rules.
The ICO is reasonable though – they know a 10-person business is different from a 500-person one. But everyone needs a basic system once it’s required.
How do I know if my automated systems need checking?
If you use software that makes decisions about people without a human being involved, you need to look at it. Examples:
- Credit scoring
- Filtering job applications
- Automatic expense categorisation
- Fraud detection
- Automated emails rejecting applications
Document your safeguards (like having humans review flagged items, letting people appeal decisions, checking accuracy regularly). Update your privacy notice to explain what’s automated.
Do I need to tell the ICO about my complaints process?
No. You don’t need to notify them that you’ve set one up. But once the requirement is live, you do need to update your privacy notice to tell people:
- How to complain to you
- That they can also complain directly to the ICO if they’re not happy with your response
ERGOS Final thoughts
GDPR is changing in 2026, but there’s no need to panic. Here’s the best bit: unlike 2018, you’ve got advance warning this time. Most changes haven’t happened yet, which means you can prepare properly instead of rushing to catch up.
These changes make compliance clearer and, in some areas, easier. Use 2026 to get ready at a sensible pace. Sort out your cookie compliance now (it’s already being enforced), then prepare for the other changes as they come in throughout the year.
You don’t need to do this alone. Whether you need help with technology, security systems, or just want someone to explain what these changes mean in plain English, we’re here.
Get in touch with ERGOS for a straightforward chat about keeping your Sussex business compliant – without the stress.
Useful links:
- ICO UK GDPR Guidance
- Data Use and Access Act 2025 – Government Guidance
- ICO International Transfers Guidance
- ICO Cookie Compliance Guidance
- ERGOS IT Compliance Services
Published: January 2026
Last updated: January 2026
This blog post gives general guidance on GDPR compliance and isn’t legal advice. If you have specific legal questions about data protection, talk to a qualified data protection lawyer or solicitor. The dates mentioned are based on government statements and might change – always check the ICO website for the latest updates.