UK Data Protection Law Just Changed — Here's What Djangify Store Owners Need to Do Before 19 June 2026
If you run an online store in the UK. Or sell to UK customers. There is a legal deadline coming up that you need to know about. On 19 June 2026, a new statutory right comes into force under the Data (Use and Access) Act 2025 (DUAA). It affects every business that collects personal data, including every store built on Djangify.
I'm not a solicitor, and nothing in this post is legal advice. But as someone who builds and runs digital storefronts for a living, I've been working through what this means for Djangify and the stores on it and I want to share what I've found so you're not caught off guard.
What's actually changing on 19 June 2026
The DUAA received Royal Assent on 19 June 2025 and has been rolling out in stages. The change coming on 19 June 2026 is specific: your customers now have a statutory right to complain directly to you about how you handle their personal data.
This isn't just a goodwill thing. It's a legal obligation. Here's what it means in practice:
- A customer can formally complain to you about a data breach, how you're storing their information, an unsubscribe that didn't work, anything related to their personal data
- You must acknowledge that complaint within 30 days
- You must provide a full response without undue delay
- If they're not satisfied with your response, they can escalate to the ICO (Information Commissioner's Office)
The ICO has been clear that they want complaints handled at business level first, before they get involved. That's actually good news — it means you have the chance to resolve things directly rather than having a regulator land in your inbox.
Does this apply to my Djangify store?
Yes, if any of the following are true:
- Your business is based in the UK
- You sell to customers in the UK
- You collect email addresses, purchase data, or any other personal information from UK residents
That covers the vast majority of Djangify store owners. Even if you're selling digital products to a global audience, if UK residents are buying from you, UK GDPR applies to that data.
What you need to do
The practical fix is straightforward. You need to:
- Add a complaints procedure to your privacy policy that is clearly signposted
- Have a way for people to submit a complaint - an email address is sufficient
- Be ready to acknowledge within 30 days - set up a label in your inbox if that helps
You don't need a data protection officer. You don't need expensive legal software. For a small digital product business, this is genuinely a one-hour job.
The paragraph to add to your privacy policy
Below is suggested wording you can use as a starting point. This is provided for information only. You must do your own due diligence and seek professional legal advice if you are unsure whether this wording is appropriate for your specific business circumstances. Djangify accepts no liability for how you use this text.
Data Protection Complaints
You have the right to raise a formal complaint with us about how we handle your personal data. To do so, please email [your email address] with the subject line "Data Protection Complaint" and include details of your concern.
We will acknowledge your complaint within 30 days of receipt and provide a full response without undue delay.
If you are not satisfied with how we have handled your complaint, you have the right to escalate it to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
Add this as a new section in your existing privacy policy, or as a clearly labelled subsection under your current "Your Rights" section. Also add the right to complain to you directly to your list of data subject rights if you have one.
What happens if you don't comply
The ICO has said publicly that they're not looking to catch small businesses out — their goal is awareness and compliance, not fines. But the obligation is real. Non-compliance with UK GDPR can result in enforcement action, and the ICO's powers have been strengthened under the DUAA.
More practically: if a customer can't find how to raise a concern and goes straight to the ICO, that's a worse outcome for you than having a clear email address in your policy.
What Djangify has done
I've updated the Djangify privacy policy to include the new complaints procedure ahead of the 19 June deadline. If you use Djangify's default policy template, check whether your version reflects this.
If you've written your own privacy policy for your store, which you should have done, since your business details need to be in there — now is the time to add this section.
Quick checklist before 19 June
- [ ] Privacy policy includes a data protection complaints section
- [ ] A contact email is clearly provided for complaints
- [ ] You're ready to acknowledge complaints within 30 days
- [ ] Your privacy policy links to the ICO as the escalation route
That's it. Small lift, real legal protection, and it demonstrates to your customers that you take their data seriously - which, when you're asking people to trust you with their purchase information, matters.
This post is for informational purposes only and does not constitute legal advice. For advice specific to your business, consult a qualified UK data protection solicitor or the ICO's own guidance at ico.org.uk.
