2026 is a year of change for employers, not least because of the implementation of various aspects of the Employment Rights Act 2025 alongside other new laws.

Published: 9 September 2026
Authors: Gwynneth Tan

This year is a year of change for employers, not least because of the implementation of various aspects of the Employment Rights Act 2025 alongside other new laws.

We set out what the changes are and how employers will need to update their data protection policies, notices and practices to ensure they remain compliant.

Applicant and workforce privacy notices

(1) Complaints process

Following changes to the Data Protection Act 2018 made by the Data (Use and Access) Act 2025 (DUAA) in the UK, from 19 June 2026, organisations must make data subjects aware of their right to make a data protection complaint about how their personal data has been handled, and have an  accessible complaints-handling framework in place.

This means that complaints must be capable of being received, acknowledged within 30 days, investigated and responded to without undue delay.

Employers should therefore review any existing applicant and workforce privacy notices and update them to include details of the right to complain and the process which the organisation has in place to handle such complaints.

(2) Equal opportunities monitoring

The Employment Rights Act 2025 (ERA25) will introduce mandatory equality action plans. In addition, the government has confirmed its intention to introduce mandatory ethnicity and disability pay gap reporting to sit alongside the existing gender pay gap reporting obligations.

Whilst such monitoring is usually carried out on an anonymous basis, the data collected to produce the necessary pay gap reports will include special category personal data. Employers should ensure that any privacy notices clearly set out the type of data that will be collected for these purposes and explain how that data will be processed, the extent to which it will be anonymised or aggregated, and for how long it will be retained. The more transparent the organisation is about what it does with this data, the more likely that employees will be prepared to disclose the information making the employer’s pay gap reporting more accurate and helping to inform what actions to focus on in the employer’s equality action plan.

(3) Holiday records

In April 2026, the ERA25 introduced new obligations for employers to maintain holiday leave and holiday pay records for 6 years. Employers should therefore ensure their privacy notices include details of what records will be kept, for how long and for what purpose.

Data subject rights requests: Response letters

As a result of the DUAA, when sending responses to data subject rights requests (such as DSAR responses and rectification requests) from employees, the employer will need to reference the right to complain and the process to follow. If the employer has a template response letter, this should be updated to include details of the right to complain and any process which the organisation has in place to handle such complaints.

Data retention policies

From October 2026, the time limit in which employees can bring claims in the employment tribunal will increase from three to six months.

Last December also saw an increase in the time period during which Acas can carry out pre-claim conciliation to 12 weeks. During any pre-claim conciliation period, the clock is effectively paused for calculating the time limit for bringing a claim in the employment tribunal.

These two changes together mean that, for example, an unfair dismissal claim may not be issued in the employment tribunal until nine months after the employee’s employment is terminated. In addition, the volume of cases currently before the employment tribunals means that delay in being notified that a claim has been brought, or in the final hearing date, is inevitable.

Employers should therefore review the currently stated retention periods for employment documents, such as personnel files, in their retention policies and guidance and, if necessary, extend the retention period to allow for these increased time limits. Where documents could be relevant for employment litigation it would be reasonable to hold them for 15 months post termination initially to see if a claim is brought, and then during any period of litigation if a claim does arise.

If you would like any assistance in updating your employment data protection documents, please contact Gwynneth Tan or Stuart Lawrenson.