Data (Use and Access) Bill: What’s the Impact?

This bill aims to simplify data sharing and use in a way that benefits both consumers and businesses. One of the biggest developments is the introduction of data intermediaries - trusted third parties who can help individuals share their data more safely and effectively with companies they want to work with.

For SMEs, this could open up new opportunities to access customer insights and deliver more tailored services - provided you're compliant with the new rules. The bill also refines how organisations handle Data Subject Access Requests (DSARs), reduces red tape around international data transfers, and proposes a framework for trusted digital ID systems.

In essence, the bill offers clearer guidance while creating more room for innovation, if businesses are prepared to adapt.

Cyber Infrastructure and Security Bill: Building Digital Resilience

The companion bill focuses on cybersecurity - a growing concern for SMEs who are increasingly targeted by cyber threats but may lack the internal resources to manage them.

The bill expands the range of organisations subject to regulatory oversight, including IT providers and digital suppliers. It also introduces stricter incident reporting requirements and enhances the powers of regulators to audit and enforce cybersecurity standards.

For SMEs, this means taking a closer look at your risk exposure, especially across supply chains and third-party systems, and ensuring your response plans are up to date.

Why This Matters for SMEs

While these reforms are designed to bring consistency and clarity, they also raise the bar for responsibility. That can feel like added pressure for smaller teams already wearing multiple hats.

But here’s the upside: engaging with these changes now means you can get ahead of the curve. You’ll be better positioned to manage risks, respond to customer concerns with confidence, and build trust in your brand. And as larger clients and public sector bodies demand higher standards from their partners, being compliance-ready could become a competitive advantage.

What You Can Do Today

You don’t need to overhaul everything at once. Start with small, meaningful steps:

1. Review how you collect and store personal data.
2. Identify your third-party providers and assess cybersecurity risks.
3. Ensure your policies are up to date and reflect the new legal direction.

Most importantly, don’t try to go it alone. These changes may be complex, but support is available.