What is a Section 278 Agreement?

A Section 278 Agreement is a legal agreement between a developer and a highway authority to carry out highway works.

Data Protection Complaints: New Employer Obligation Now In Force

A significant change to UK data protection law came into force on 19 June 2026. Under the Data (Use and Access) Act 2025, employees and other individuals now have a legal right to raise data protection concerns directly with an organisation before taking their complaint to the Information Commissioner’s Office (ICO).

For HR professionals, this means that data protection issues are increasingly likely to land on your desk first.

Complaints could cover a wide range of workplace issues, including employee monitoring, mistakes in personnel records, delays in responding to subject access requests, inappropriate sharing of personal information, or concerns about how artificial intelligence (AI) is being used in employment decisions.

One important point for HR teams to understand is that employees do not need to use legal language when raising a concern. They may not even describe it as a complaint. For example, an employee saying, ‘I don’t think you should be using my information like that’ could be enough to trigger an organisation’s obligations under the legislation.

The new law requires organisations to have a process for handling data protection complaints. Employers must acknowledge complaints within 30 days and investigate and respond without unnecessary delay. Failing to do so could potentially amount to a breach of data protection law in its own right.

This represents an important change in practice. In the past, many data protection concerns were raised directly with the ICO. Employers are now expected to deal with these issues internally, wherever possible, and to demonstrate that they have effective procedures in place for receiving, investigating and resolving complaints.

HR teams should take steps now to review their current arrangements. Policies and procedures should be updated where necessary, complaint reporting channels should be clear and accessible, and managers should receive training to help them recognise when a data protection complaint has been raised. Escalation routes should also be reviewed to ensure concerns are referred promptly to the appropriate individuals within the organisation.

About Jon Dunkley

Jon Dunkley is a Partner at Wollens and heads up the firm’s Regulatory Department. Based at our North Devon office, Jon is a highly experienced solicitor with a broad commercial and regulatory practice, supporting businesses, professionals and senior employees across a wide range of legal issues.