Website Compliance and DUAA
Updates to data protection laws in the UK have been in place since the start of February 2026, so if you have not reviewed your website since then, there is a reasonable chance it is no longer in line with the updated requirements, potentially making it non-compliant. The consequences of getting this wrong have become significantly more serious.
The Data (Use and Access) Act 2025 (DUAA) received Royal Assent in June 2025 and brought a number of practical changes to the Privacy and Electronic Communications Regulations (PECR). These are the strict set of rules that govern cookies and online tracking technologies.
In this guide, our compliance teams, in conjunction with our partner marketing firm FireTap Legal, provide information on what has changed, what your firm needs to do now, and how we can help with our DUAA website audit and implementation services.
Changes have already started to be introduced, with final implementation planned for 19 June 2026, with functional changes affecting law firms, including:
- Cooke Consent Exemptions
- Complaint Handling Policy
- You also have to acknowledge complaints within 30 days and respond to them ‘without undue delay’.
- Data Subject Access Requests:
- stop the clock provision
- reasonable and proportionate searches
For a Full list of changes, click here: https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/
What Law Firms Need to Know – Cookies
There are some positives to highlight first, in that many of the changes DUAA is bringing in are intended to make things easier, rather than introducing complex new obligations.
- Exceptions and caveats
DUAA introduces three new categories of cookies that no longer require user consent:
- Analytics cookies: provided they are used solely by your firm to understand how your website is used, and the data is not shared with third parties for advertising purposes.
- Functional cookies: provided their sole purpose is to enable or enhance how your website works or appears, such as remembering accessibility settings or language preferences
- Emergency assistance cookies: a narrow category for geolocation in emergency situations
There are firms for which this means analytics tools such as Google Analytics can potentially operate without a consent banner toggle, simplifying the user experience and reducing friction on your website. However, there are some important caveats to take into consideration.
These exemptions are only applicable under certain conditions. For example, the analytics cookies exemption only applies if your analytics platform is configured correctly. If your Google Analytics account shares data with Google for advertising purposes, or if you use analytics data to build advertising audiences, the exemption does not apply, and consent is still required.
For both new exempt categories, users must still be given clear information about the cookies in use and a simple, free way to opt out. It is important to remember that exemption does not mean invisibility. For websites that utilise advertising and targeting cookies, including those placed by Google Ads, Meta, LinkedIn, and similar platforms, the rules remain unchanged. Informed consent is still required before any advertising cookie is set.
- Penalty updates
Although some of the cookie consent requirements have been relaxed, DUAA has significantly increased the maximum penalty for PECR breaches. The ceiling has risen from £500,000 to £17.5 million, or 4% of global annual turnover, whichever is higher. This brings PECR fines in line with UK GDPR, and means that cookie consent failures are no longer a low-stakes compliance matter.
- Compliance Obligations
One of the most significant changes concerns complaint procedures. From 19 June 2026, every organisation that processes personal data must have a formal data protection complaints procedure in place. This is a new statutory requirement. Organisations must acknowledge complaints within 30 days and maintain a documented process for handling and responding to them. A line in your privacy policy pointing people to the ICO is no longer sufficient.
What Law Firms Need to Consider
For firms regulated by the Solicitors Regulation Authority (SRA), there is an additional layer of regulation. The DUAA complaints handling obligation sits alongside, but is not identical to, the SRA’s existing complaints requirements. Both must be satisfied, and they must be consistent across your website. A privacy policy that describes one complaints process and a complaints page that describes another creates a regulatory inconsistency that neither the ICO nor the SRA would look favourably upon.
What To Do Now
The first step is a straightforward website review, assessing your cookies, your consent banner, your tag manager configuration, and your privacy documentation against the new rules. Most organisations will need at least some updates. Many will have advertising tags currently firing without proper consent in place, which represents a live breach at the new penalty levels.
DUAA Website Compliance Audit
Regulation and Compliance Office and FireTap Legal have joined together to offer Firms a range of solutions which will provide you with:
- A new complaint policy for data related complaints
- A cookie policy review and a new cookie policy if required
- Guidance note for handling DSARs
| Service | What’s Included | Price |
| Core Website Package | • Updated data protection complaints policy • Cookie policy review and updated cookie policy • DSAR guidance note | £500 + VAT |
| Core Website Package + Training | Everything in the Core Website Package, plus a GDPR/DUAA training session (course preparation, delivery and detailed handout). In-person: £2,000 + VAT | Online: £1,800 + VAT | From £1,800 + VAT |
| Core Package + Training + Full Policy Suite | Everything in the Core Package and Training option, plus the complete GDPR and DUAA policy suite. | From £2,000 + VAT |
Find out more about our full range of services here: GDPR & Data Protection Audit, Compliance, and Training Services.
For firms wanting comprehensive, ongoing data protection compliance, not just a one-off fix, our Annual GDPR & Data Protection Compliance Service provides complete managed protection as an annual subscription.
| Annual Compliance Service — What’s Included | Annual Cost |
| ✔ Full set of GDPR & DUAA A policies, controls and procedures (PCP’s) — drafted and maintained for you | From £3,000 + VAT per annum |
| ✔ Internet and website policies included | |
| ✔ Annual GDPR audit with full written report | |
| ✔ Annual GDPR training for all staff | |
| ✔ Ongoing policy updates as legislation and regulation changes | |
| ✔ Compliance helpline — raise queries as they arise | |
| ✔ Regular regulatory briefings and newsletters |
Download the brochure for detailed information on this service: GDPR Data Protection Compliance Service.
Already on our SRA Compliance Essentials service?
GDPR policies are included as standard, so much of what is covered in these standalone policy packages is already taken care of for you. If you already have our website add-on package, our compliance team will be in touch to get these updated for you as part of that service.
What Law Firms Need to Know – Complaints
It is recommended that firms implement a Complaint Policy accessible via their website, setting out how to complain about a data breach or data-related issue and setting out how the firm will handle and deal with the complaint.
It is important to cover key areas such as:
- Acknowledgement
- Time to deal and respond
- When and how to complain to the ICO
What Law Firms Need to Know – Training
The ICO recommends that training is provided annually to all staff as a sensible step to help control and minimise data breaches.
With the changes already underway, this is a perfect time to provide training for all staff.
Our training solutions will cover all the essential areas, including the updates, and provide a framework for dealing with data breaches and Data Subject Access Requests.
What Law Firms Need to Know – Policies, Controls, and Procedures
The ICO and the SRA expect firms to document its compliance with UK GDPR through a set of policies, controls, and procedures. Compliance with GDPR is not optional; it is essential, and failing to document your procedures and train staff can have consequences in terms of regulatory investigations and fines. To prevent this, a set of detailed policies, controls, and procedures is recommended. If you require these as a standalone option, the cost is £1,200 + VAT.
The Policies will include:
- A GDPR and DUAA Policy
- Data Retention Policy
- Bring Your Own Device Policy
- IT and Cybersecurity Policy
- Information Security Policy
- DSAR notices
- Data Notices
- Clients
- Employees
- Data Protection Impact Assessment Template
- Data Protection Privacy Notices
- Employees
- Recruitment
For RACO Member firms using our SRA Compliance Essentials services, we will be in touch to discuss any updates needed. If you are a firm that does not utilise our Risk and Compliance Services, you can find more information below.
Our Compliance Services
At the Regulation & Compliance Office, we can offer a number of outsourced support solutions, including:
- SRA Compliance Essentials – SRA Compliance Essentials gives you ongoing, specialist support to meet SRA Standards and Regulations and, where relevant, Anti-Money Laundering Regulations. It’s designed to give you peace of mind and free up time, while helping you evidence a robust compliance environment to the SRA and insurers.
- Regulation & Compliance Management – Risk & Compliance Management provides law firms with a dedicated external compliance function. It operates as an extension of your firm, delivering day-to-day regulatory guidance, register administration and structured reporting without the cost of a full in-house compliance department.
Find out more about our full range of Data Protection and GDPR services here: GDPR & Data Protection Audit, Compliance, and Training Services.
Contact Us To ask any questions about the Regulation and Compliance Office and how we can support your Law Firm, please call us on 0203 985 8550, complete the online enquiry form, or email us at info@regulationandcomplianceoffice.co.uk
