For compliance officers, data protection leads, and senior managers across UK regulated industries, the next few weeks represent one of the most consequential compliance windows since GDPR came into force. The Data (Use and Access) Act 2025 (DUAA) — which received Royal Assent on 19 June 2025 — reaches its most significant implementation milestone in June 2026, and the consequences of non-compliance have never been more severe.

With the ICO having already issued its largest-ever fine of £14 million against Capita for cybersecurity failures, and PECR penalties now aligned with UK GDPR at up to £17.5 million or 4% of global turnover, the regulatory environment demands immediate, documented action — particularly around how your organisation manages, retains, and destroys sensitive documents and data.

This article sets out exactly what finance, legal, and healthcare firms need to do before the June 2026 deadline, with a specific focus on document destruction compliance.

1. Mandatory Formal Data Protection Complaints Process

From June 2026, every organisation processing personal data must have a formal, documented complaints handling process in place. This is not optional — it is a legal requirement under the DUAA.

Key requirements include:

• Accessible complaints submission — visible links from privacy notices, electronic and written complaint forms
• 30-day acknowledgement — controllers must acknowledge complaints within 30 days
• Mandatory record-keeping — logs of receipt dates, investigation methods, remedial actions, and outcomes
• Pre-ICO escalation — individuals must now raise complaints with the controller first before escalating to the ICO

For document-intensive industries like finance, legal, and healthcare, this means your complaints process must be able to handle queries about how long documents are retained, when they are destroyed, and what destruction records exist.

2. Strengthened ICO Enforcement Powers

The ICO is being replaced by the Information Commission in 2026, with significantly expanded enforcement capabilities. These include:

• Power to compel witnesses and commission technical reports
• Fines up to £17.5 million or 4% of global turnover for both GDPR and PECR breaches
• Ability to assess fines based on holding company revenue (as seen in the LastPass case, where the fine was calculated on the investment holding company's global revenue)

3. Phased DUAA Implementation Completing

The final tranche of DUAA provisions comes into force in June 2026, including:

• Updated Subject Access Request (SAR) rules with "reasonable and proportionate" search standards
• New automated decision-making framework
• Revised cookie consent exemptions
• Relaxed international data transfer test

The ICO's recent enforcement actions make clear that document and data destruction is no longer a back-office function — it is a front-line compliance obligation.

The Capita Warning

The ICO's £14 million fine against Capita (reduced from £45 million) centred on inadequate security controls that exposed the personal data of 6.6 million people. The ICO found that poor access controls, insufficient security testing, and inadequate staffing created "a foreseeable and avoidable risk." Critically, the ICO cited internal security documents — including penetration test reports — as evidence of known but unaddressed vulnerabilities.

The lesson for document-heavy industries: Your internal compliance records, destruction logs, and security assessments are discoverable by the ICO. They must demonstrate proactive, systematic compliance — not reactive patching.

The LastPass Precedent

The ICO fined LastPass UK Limited £1.2 million, calculated on the global revenue of its investment holding company — not just LastPass itself. This means private equity-backed firms, group structures, and holding companies in finance and healthcare face significantly higher fine exposure than they may have assumed.

Financial Services

Banks, investment firms, and fintech companies must balance the DUAA's data-driven innovation provisions with stringent security obligations. Key document destruction requirements include:

• FCA-mandated retention periods for client records, transaction data, and communications (typically 5–7 years)
• Systematic destruction schedules aligned with the DUAA's "reasonable and proportionate" SAR search standard
• Audit trails for all destruction activities, particularly for records subject to regulatory review
• Third-party processor contracts updated to reflect DUAA obligations, including destruction certification requirements

Under the DUAA's new automated decision-making framework, financial institutions using AI for credit scoring, fraud detection, or customer segmentation must also ensure that training data and model documentation are subject to appropriate retention and destruction policies.

Legal Sector

Law firms face unique challenges under the DUAA's updated SAR framework. The "reasonable and proportionate" search standard directly impacts legal discovery and document retention practices. Firms must:

• Implement systematic document lifecycle management covering creation, retention, and certified destruction
• Update client data handling policies to reflect DUAA changes
• Ensure matter files are destroyed in accordance with documented retention schedules, with certificates of destruction issued
• Prepare for ICO guidance on subject access expected in Spring 2026, which will clarify obligations for legal privilege and third-party data in SARs

The Solicitors Regulation Authority (SRA) expects firms to maintain robust data protection compliance as part of their regulatory obligations — DUAA non-compliance could trigger SRA as well as ICO scrutiny.

Healthcare

NHS trusts, private healthcare providers, and medical practices must navigate the DUAA's broad consent provisions for scientific research alongside strict patient data protection requirements. Document destruction priorities include:

• Medical record retention schedules aligned with NHS guidelines (typically 8 years for adult records, longer for children)
• Certified destruction of physical patient records, prescription records, and clinical notes
• Digital data destruction protocols for decommissioned systems and devices
• Supplier contracts requiring destruction certification from third-party processors

Healthcare continues to experience the highest average cost of a data breach of any industry, according to IBM's Cost of a Data Breach Report — making proactive document destruction a direct financial risk management tool.

With the deadline weeks away, here is a prioritised action plan for regulated industry compliance officers:

Immediate Actions (Complete Before June 2026)

☐ 1. Establish Your Formal Complaints Process
Draft or update your data protection complaints handling policy. Create submission forms, acknowledgement templates, and logging systems. Test the process before the deadline.

☐ 2. Audit Your Document Destruction Schedules
Review all document retention and destruction schedules against DUAA's "reasonable and proportionate" standard. Identify gaps where destruction is overdue or undocumented.

☐ 3. Obtain Certificates of Destruction
Ensure all physical document destruction is carried out by a GDPR-compliant, certified shredding provider that issues formal certificates of destruction. These are your primary evidence of compliance in an ICO investigation.

☐ 4. Update Third-Party Processor Contracts
Review contracts with document storage, shredding, and data processing suppliers. Ensure they reflect DUAA obligations, including destruction certification and audit trail requirements.

☐ 5. Review SAR Processes
Update your Subject Access Request procedures to reflect the DUAA's "reasonable and proportionate" search standard. Ensure your document management systems can efficiently locate and retrieve personal data.

☐ 6. Assess Cookie and PECR Compliance
With PECR penalties now at £17.5 million, review consent banners and cookie policies. Ensure reject options have equal prominence to accept buttons.

Ongoing Actions

☐ 7. Monitor ICO Guidance Releases
The ICO is releasing updated guidance throughout 2026 on legitimate interests, automated decision-making, storage and access technologies, and international transfers. Assign responsibility for tracking and implementing these updates.

☐ 8. Conduct Tabletop Breach Exercises
Simulate data breach scenarios to test your incident response procedures. The ICO expects continuous, engaged responses — not just prompt initial notification.

☐ 9. Benchmark Cybersecurity Against NCSC Guidance
The ICO extensively cited NCSC guidance in both the Capita and LastPass decisions. Benchmark your security posture against NCSC standards and document the assessment.

Given the heightened enforcement environment, the choice of document destruction partner is a compliance decision, not just a procurement one. When selecting a provider, look for:

• BS EN 15713 certification — the British Standard for secure destruction of confidential material
• GDPR-compliant processes with documented chain of custody
• Certificates of destruction issued for every collection
• Audit trail documentation suitable for ICO review
• Secure on-site or off-site shredding options appropriate to your sensitivity requirements
• Regular scheduled collections to prevent accumulation of sensitive material

For regulated industry professionals preparing for the June 2026 deadline, the following authoritative resources provide essential guidance:

1. ICO Guidance on the Data (Use and Access) Act 2025 — The ICO's official implementation plans and forthcoming guidance schedule
2. Gowling WLG: Top Five UK Data Protection Developments for 2026 — Expert legal analysis of the key changes and practical steps
3. Skadden: Recent ICO Data Breach Enforcement — Detailed analysis of the Capita and LastPass enforcement decisions and lessons for all organisations

The June 2026 DUAA deadline is not a distant horizon — it is weeks away. For finance, legal, and healthcare firms, the combination of mandatory complaints processes, strengthened ICO enforcement powers, and record fines creates an environment where documented, systematic compliance is the only defensible position.

Document destruction sits at the heart of this compliance challenge. Every piece of sensitive material that is retained beyond its required period, destroyed without certification, or managed without a documented process represents a potential ICO enforcement risk.

The organisations that will navigate 2026 successfully are those that treat document destruction as a strategic compliance function — not an administrative afterthought.

This article provides general guidance and should not be considered legal advice. Organisations should consult with qualified legal professionals for specific compliance requirements.