Risk Radar | June 2026

Data Protection

Data protection complaints regulations come into force

The Data (Use and Access) Act 2025 sets outs new rules that businesses must follow when handling data protection complaints effective from 19 June 2026. Businesses will need to operate compliant complaints procedures and ensure that data rights concerns are managed consistently and in line with ICO expectations.

See the ICO's article here and guidance on the rules here.

Government publishes Smart Data strategy

The government has published its strategy on the implementation of Smart Data programs in the UK, with retail identified as a key target sector for Smart Data schemes. Retailers should begin preparing for increased expectations around data portability, governance and third-party access.

Read the strategy here, and the result of the government's call for evidence here. 

ICO advises government on online advertising

The ICO has written to the government regarding changes to the rules around data collection and storage for online advertising. It has concluded that the law could be amended to remove the requirement for consent to storage of data (e.g. cookies) in some low-risk situations. This reflects a potential move toward a more risk-based framework and may reduce friction in digital marketing.

Read the ICO's report here, and a summary of their findings here. 

Marketing updates

CMA publishes its Annual Plan

The CMA published its Annual Plan for 2026 - 2027 which confirms a continued focus on consumer protection and competition, with greater use of its powers under the Digital Markets, Competition and Consumers Act. Enforcement is expected to target practices such as drip pricing and fake reviews, supported by increased use of AI and data analytics to identify anti-competitive conduct.

First rulings under LHF regulations

The ASA’s first rulings under the new LHF advertising restrictions highlight that compliance is highly context-specific, with a key issue being whether an advert promotes an identifiable LHF product. Ads featuring LHFs prominently are likely to be caught, whereas incidental inclusion may fall outside scope.

See our article here.

The Tobacco and Vapes Act 2026

The Tobacco and Vapes Bill received Royal Assent on 29 April 2026 and has become the Tobacco and Vapes Act 2026 (the 'Act'). The Act, among other things, introduces new restrictions on the advertising of tobacco, vaping products, nicotine-containing and related products, which will come into force on a date specified in regulations by the Secretary of State.

Compliance updates

Martyn's Law – New Guidance

The government has published guidance on security requirements under Martyn’s Law, including obligations for premises where more than 200 individuals may be present. Large retail premises are likely to fall within scope and should begin assessing compliance ahead of full implementation.

UK's New Product Safety Framework

Consultations under the Product Regulation and Metrology Act 2025 mark the most significant reform of the UK’s product safety framework in two decades. The proposals signal a shift toward more proactive obligations across the supply chain, alongside enhanced enforcement powers.

See further here.

Ban on destruction of unsold clothing

From 19 July 2026, large retailers selling into the EU or Northern Ireland will be prohibited from destroying unsold clothing, footwear and accessories under the Ecodesign for Sustainable Products Regulation. The rules will require greater focus on reuse, resale and donation, with implications for stock management and returns processes.

Expanded corporate criminal liability

The Crime and Policing Act 2026 introduces a broader test for corporate criminal liability, whereby organisations may be liable where a senior manager commits an offence within the scope of their authority. The changes significantly extend exposure to fraud, bribery and other economic crimes, with implementation anticipated from June 2026.

SFO enforcement action highlights bribery risk

The SFO has secured a £14.8 million penalty and costs against Ultra Electronics following a deferred prosecution agreement for failure to prevent bribery. The case reinforces the importance of robust anti-bribery controls and effective compliance frameworks.

Financial services updates

Financial promotions reform and Consumer Duty alignment

Firms can expect a simplification of the FCA’s financial promotions regime for consumer credit, with a shift towards outcomes-based regulation under the Consumer Duty. The proposals aim to improve consumer understanding while removing overly prescriptive requirements.

Key implications include:

• removal of rules in CONC 3 that duplicate or overlap with the Consumer Duty’s consumer understanding outcome
• retention of the “clear, fair and not misleading” rule, preserving consumers’ private right of action
• potential changes to cost disclosure requirements, including how APR is presented and understood

The FCA is also seeking feedback on whether existing disclosure rules (particularly around APR) effectively support consumer understanding, given evidence that many consumers misunderstand representative rates.

Firms should review their financial promotions and disclosure practices now, and consider responding to the consultation ahead of the 17 June 2026 deadline. See here.