Skip to content
Legal monitoring

🚨 Your risk report: key legal changes affecting your business (September 2026)

Last reviewed:

🔎 Executive summary – key actions this autumn:

Applies to: Employers in England, Wales and Scotland

Following the day-one rights and SSP reforms that took effect in April, the government has published a revised implementation timetable, scheduling several further changes for this autumn. The dates below remain subject to parliamentary processes:

  • 1 October 2026: The time limit for bringing most employment tribunal claims doubles from three to six months, meaning employers face a longer window of uncertainty after dismissals, grievances or resignations. For breach-of-contract claims in Scotland, the change will take effect on 9 November 2026 instead. Broadly, the extended limit applies where the relevant event occurs on or after the applicable commencement date.
  • 30 October 2026: A new duty requires employers to take "all reasonable steps" to prevent sexual harassment, alongside new protections against harassment by third parties such as clients or customers.
  • Looking ahead to January 2027: The qualifying period for unfair dismissal protection will fall to six months, and the compensation cap will be removed. The new qualifying period will apply to dismissals taking effect on or after 1 January 2027. Employees who remain employed and already have at least six months’ continuous service will therefore benefit from the change from that date. Hiring decisions made from mid-2026 onwards should factor this in.

đź”´ Action required:

  • Update grievance and disciplinary procedures to reflect the longer tribunal claim window, and review how long you retain relevant records. The longer tribunal time limit does not itself impose a new statutory retention period, but longer retention may be sensible risk management.
  • Review and strengthen your anti-harassment policy ahead of 30 October, including procedures covering third-party harassment (customers, clients, contractors).
  • Start planning for the January 2027 unfair dismissal changes if you are recruiting now.

Applies to: All organisations processing personal data in the UK

All data protection provisions of the Data (Use and Access) Act 2025 (DUAA) came into force on 19 June 2026, and the ICO has updated its guidance accordingly. Key practical points for SMEs:

  • Subject access requests: You are only required to carry out "reasonable and proportionate" searches when responding to a DSAR; you do not need to search everywhere regardless of relevance.
  • Recognised legitimate interests: Certain processing activities (including some fraud prevention, safeguarding and public-interest purposes) no longer require a full balancing test. The processing must still be necessary and meet one of the prescribed recognised legitimate-interest conditions.
  • Complaints handling: A statutory duty now requires organisations to have a compliant internal process for handling data complaints. Organisations must provide a clear way to complain, acknowledge complaints within 30 days, investigate them appropriately and communicate the outcome.
  • Cookie/marketing rules: Some "storage and access technology" (cookie-type) exemptions have been broadened, and charities benefit from a "soft opt-in" for email marketing to existing supporters.

đź”´ Action required:

  • Check that your privacy notice references "recognised legitimate interests" correctly where relevant.
  • Confirm you have a documented internal complaints-handling procedure in place, as this is now a statutory requirement rather than best practice.
  • Review your SAR process to ensure it reflects the "reasonable and proportionate" search standard, rather than more onerous internal practices.

⚖️ Update: Subscription "trap" rules pushed back again to spring 2027

Applies to: Businesses selling to consumers (B2C), especially subscription models.

In our last report, we flagged the DMCCA's new subscription contract rules as being due in autumn 2026. The government has since confirmed a further delay: the regime is now expected to commence in spring 2027. This remains an anticipated date rather than a confirmed statutory commencement date.

The government has also published its response to the 2024 consultation, giving a clearer picture of what to expect:

  • The new rules will broadly follow the existing Consumer Contracts Regulations 2013 framework, rather than an entirely new regime.
  • The regime provides two types of 14-day cooling-off period: an initial period after entering the subscription and a renewal period after a free or discounted trial converts, or after a subscription renews for a further period of at least 12 months.
  • Certain sectors (insurance, financial services, some charitable/cultural memberships) are expected to remain excluded, subject to the final regulations.

While the specific subscription rules are delayed, the CMA continues to enforce other parts of the Digital Markets, Competition and Consumers Act 2024 (DMCCA), including the rules against fake reviews and drip pricing.

đź”´ Action required:

  • Use the extra time to prepare. Auto-renewal reminder notices, clear pre-contract information and easy cancellation routes will all be required eventually, even though the deadline has moved.
  • Continue to review your subscription funnels, pricing pages and practices for collecting reviews against existing DMCCA obligations, which are already enforceable.

⚖️ On the horizon: Commercial Payments Bill targets late payment culture

Applies to: Businesses selling to businesses (B2B)

A Bill was formally introduced to Parliament on 19 May 2026 to tackle late invoice payments. The government described it as the biggest crackdown on late payment in over 25 years. It is not yet law. The Bill completed report stage in the House of Lords on 15 September 2026, with third reading scheduled for 20 October 2026. Its provisions may still change during the parliamentary process.

Key proposals currently include:

  • A maximum 60-day payment period for most in-scope commercial contracts, subject to limited exemptions, with non-compliant terms generally void.
  • Mandatory statutory interest on late payments, set at 8% above the Bank of England base rate.
  • A ban on withholding retention payments under construction contracts.
  • Suppliers will be entitled to a statutory fixed sum where a purchaser raises a payment dispute late or fails to provide sufficient information for the supplier to understand it.
  • Strengthened powers for the Small Business Commissioner to investigate, adjudicate disputes and fine persistent late payers, with fines potentially reaching tens of millions of pounds for the worst offenders.
  • An adjudication scheme with binding interim decisions for payment disputes involving businesses with fewer than 50 staff.

đź”´ Action required:

  • If you are a smaller supplier to larger customers, start keeping clear records of agreed payment terms and any late payments now. This will support both existing rights (including your right to charge statutory interest today) and any future Small Business Commissioner claim.
  • If you are a larger business paying smaller suppliers, review your standard payment terms and consider whether they will need to move towards the proposed 60-day cap. We will update you as the Bill progresses through Parliament and dates are confirmed.

Real estate

Applies to: Landlords in England letting residential property.

Phase 1 of the Renters’ Rights Act 2025 (RRA) came into force on 1 May 2026 as planned, abolishing assured shorthold tenancies and Section 21 notices. Landlords should now be operating under the new Assured Periodic Tenancy regime. Phase 2 will begin with the regional rollout of the PRS Database from late 2026. Mandatory Ombudsman membership is expected later.

  • PRS Database: The government plans to begin rolling out the new Private Rented Sector Database regionally from late 2026. Registration will become mandatory for private landlords as the system is introduced. Landlords will be required to pay an annual fee and provide prescribed contact, property and safety information, expected to include gas, electrical and energy performance certificates.
  • PRS Ombudsman: A new Ombudsman scheme is being introduced to handle tenant complaints and disputes outside the courts. The scheme will be developed in stages, with mandatory landlord membership currently expected in 2028.
  • Civil penalties: Since 1 May, enforcement has included civil penalties for non-compliance, and rent repayment orders of up to two years' rent for serious offences.

đź”´ Action required:

  • If you haven’t already, ensure your tenancy agreement reflects the new legal changes. Identify qualifying tenancies that converted automatically and audit compliance with the transitional information requirements.
  • Watch for the PRS Database launch date and prepare to register and pay the associated fee once live.
  • Review your tenant complaint-handling process before the Ombudsman scheme comes into force.

Applies to: All new and existing company directors, people with significant control (PSCs), and equivalent roles in UK companies

Since 18 November 2025, new directors have had to verify their identity when incorporating a company or being appointed to an existing company. New PSCs may provide their personal code when they are registered or within 14 days after registration. Existing directors and PSCs are in a 12-month transition period that began on 18 November 2025. However, 18 November 2026 is not one universal filing deadline: the applicable deadline depends on the person’s role and the relevant company or PSC timetable.

Companies cannot file a confirmation statement unless all directors have verified and provided their personal code. PSCs who are not also directors must generally verify within 14 days of the start of their birth month, or within 14 days of being registered.

You need to verify your identity only once through GOV.UK One Login or an Authorised Corporate Service Provider (ACSP). You can then reuse the resulting personal code across all your directorships.

Read more about the verification process.

đź”´ Action required:

  • Check your company's next confirmation statement due date and verify all directors and PSCs well ahead of that filing; do not wait until November.
  • If you hold directorships in multiple companies, you only need to verify your identity once, but the same personal code must be provided for each company through that company’s relevant confirmation statement. Meeting the first company’s deadline does not automatically complete the requirement for the others.
  • Flag this to any overseas or hard-to-reach directors now, as identity checks for them can take longer.