United Kingdom
The UK compliance timeline 2026-2027: what the DUAA and the Employment Rights Act change for SMEs
The question
UK small businesses are facing two laws that phase in over two years, not one big deadline. Here is the verified timeline — what's already in force, what's dated, and which official pages to watch.
What is true, verified
- The Data (Use and Access) Act 2025 received royal assent on 19 June 2025 and commences in stages. The biggest wave for data-protection practice — the bulk of the UK GDPR changes plus new ICO enforcement powers — was set to commence 5 February 2026, with the remainder targeted for mid-2026 (per the government's published commencement plan; check GOV.UK for the current state).
- The Employment Rights Act 2025 received royal assent on 18 December 2025 and rolls out through 2026-2027 via commencement regulations. Dated milestones published so far include April 2026 changes (day-one sick pay and paternity/parental leave among them), October 2026 (third-party harassment liability), and 1 January 2027 (the unfair-dismissal qualifying period cut). The exact set evolves — Acas maintains a dedicated hub and GOV.UK a timeline; those are the pages to watch, not summaries.
- The watchable official sources are excellent: the ICO publishes news and enforcement, Acas maintains the Employment Rights Act hub, HSE publishes press and prosecutions, and legislation.gov.uk carries every commencement instrument. A compliance alert that doesn't cite one of these is an opinion.
- The market gap is real and verified: free newsletters (Acas, CIPD, law-firm alerts) tell everyone everything; advisory subscriptions (Peninsula/BrightHR-style) run to hundreds or thousands of pounds a year. A low-cost digest sorted for YOUR business sits between them — that's the slot this engine aims at (it isn't open for the UK yet; the probe below measures whether it should be).
What to do this quarter
- Put the two hubs in your reading rotation: Acas's Employment Rights Act page and the GOV.UK implementation timeline.
- For data: if you haven't reviewed your privacy posture since the DUAA's February 2026 wave, that's the trigger — the ICO's guidance pages are the source.
The honest shortcut
The engine behind VeilleQC (official-page monitoring, sorted for your profession, every alert citing its source) can be pointed at exactly these UK sources. We only open it if demand is real: signing up on the UK probe is the vote.