What Changed on the 19th June 2026 - and What Owners of Estate Planning Businesses Need To Do
If you're a will writer or estate planner, you're already dealing with some of the most sensitive personal data there is. Client financial details, family circumstances, health information gathered for capacity assessments - the nature of what you do means data protection is central to your practice.
So when the law changes how clients can make complaints about the way their data is handled, you need to pay attention. There's a change that came into force on 19 June 2026 that requires some practical updates - including to your website (if you haven't already dealt with it).
Here's what happened, why it matters, and exactly what you need to do.
A New Law, a New Obligation
The Data (Use and Access) Act 2025 (DUAA) updated how individuals can complain about how their personal data is handled. Under the old rules, if someone had a concern, they could go straight to the Information Commissioner's Office (ICO). Now, there's a required first step: they must be able to raise the complaint with you, the organisation, before escalating to the regulator.
This isn't just good practice - it's a legal requirement. And there are no exemptions. It applies to every organisation that processes personal data, regardless of size or sector - including sole practitioner will writers and small estate planning firms.
What the New Rules Actually Require
Here's what you're now legally obliged to have in place:
1. An accessible complaints route
You must give people a clear, easy-to-find way to submit a data protection complaint directly to you. This doesn't have to be a dedicated complaints portal - it can be a specific email address, an online form, a live chat option with human escalation, or even a phone number. But it cannot be a generic "contact us" link buried in your footer. It needs to be clearly signposted as a route for data protection complaints specifically.
2. An acknowledgement within 30 days
Once someone submits a complaint, you must acknowledge it within 30 days of receipt (or the next working day if the deadline falls on a weekend or bank holiday).
3. A proper response
You need to investigate the complaint, keep the person informed of progress, and provide an outcome. The ICO's guidance suggests aiming to resolve complaints within three months where possible. Your response must be written in plain, accessible language.
4. Tell people they can go to the ICO
If someone isn't happy with your response, they have the right to escalate to the ICO. You must tell them that they are entitled to do this, and this needs to be in your written response and in your privacy notice.
5. Accept complaints however they arrive
You cannot refuse a complaint because it came in via an unusual channel. If someone sends a complaint via social media, you still have to deal with it.
What You Need to Update on Your Website
This is where most businesses need to take action. You need to:
Update your privacy notice. Your privacy notice must now include:
The individual's right to raise a data protection complaint with you directly
How to do it (the specific method - email, form, etc.)
What happens next (acknowledgement timelines, how you'll investigate)
Their right to escalate to the ICO if they're unhappy with your response
Add a clear complaints route. This should be easy to find - ideally linked from your privacy notice, and potentially from a "Data Protection" or "Your Rights" section of your website. A dedicated email address (e.g., dataprotection@yourpractice.co.uk) works well and is easy to set up. It also signals to clients that data matters to you - important when they're trusting you with financial and family information.
Consider a separate, short, complaints procedure page. Publishing a brief, plain-English explanation of how you handle data complaints helps people understand the process and demonstrates compliance. It doesn't need to be long - a few paragraphs covering how to submit, what you'll do, and the timeline is enough.
Don't Forget the Internal Stuff
The website changes are just the visible part. Behind the scenes, you also need:
A log to record complaints received, actions taken, and outcomes
Someone responsible for handling complaints (even if you are that person!)
Template acknowledgement and outcome letters so you're not starting from scratch each time
Basic awareness - anyone who might receive a complaint (including anyone who takes calls or handles client queries) should know to flag it
Why This Matters More for Will Writers and Estate Planners
Yes, this is a legal requirement. But for will writers and estate planners, there's a particular reason to take it seriously beyond box-ticking. A clear, well-run internal process gives you the chance to address concerns before they escalate, and demonstrates the kind of professional standards that build long-term client trust.
Clients who are making decisions about wills and estates are often in vulnerable circumstances. Handling any data complaint quickly, clearly, and with care is simply good practice - and now it's also the law.
The ICO has been clear that it wants to see organisations taking complaints seriously at source. Practices that have good processes in place will be in a much stronger position if they ever do face regulatory scrutiny.
What to Do This Week
If you haven't already made these changes, here's where to start:
Set up a dedicated data complaints email address
Update your privacy notice to include the right to complain and how to do it
Add a link or section on your website that signposts the complaints route
Brief whoever handles customer contact so they know to escalate data complaints
Create a simple log to record any complaints you receive
None of this needs to be complicated. But it does need to exist, be effective in the event you get a complaint, and customers and clients need to be able to find it.
Need a data protection complaints process built for will writers and estate planners? Our 'Client Data Protection Pack' provides you with a template Privacy Notice and a Data Protection Complaints Procedure that meets the new requirements. Fully editable, instantly downloadable, and priced at just £49. Get the pack
Comments