The Data (Use and Access) Act 2025 has introduced a new statutory right for individuals, including employees to complain directly to data controllers about alleged UK GDPR infringements. For employers and other data controllers, this is a significant practical compliance change, not merely a technical footnote. From 19 June 2026, privacy notices, DSAR templates and internal complaints processes will need to reflect this new change. Employers will have to be able to show that