ICO subject access guidance and the Cyber Security Bill: 2 UK SME GRC angles (2026)

The useful link between these two UK updates is evidence, not alarm. The ICO updated its subject access guidance on 16 July 2026, while Parliament reported the Cyber Security and Resilience Bill's Lords second reading on 15 July. 1 2

For a UK SME, those updates support two different posts: one about proving that personal-data requests are handled on time and securely, and one about showing customers where the business sits in a changing resilience chain. The Bill is still moving through Parliament, and it is not a blanket new duty for every small business. 3

Brief 1: Turn the ICO subject access update into an evidence test

Audience pain point

Many small businesses have a privacy policy but no reliable way to answer a subject access request when it arrives in a shared inbox, on the phone or through social media. Someone may recognise the request, but nobody can prove when the clock started, which systems were searched, who checked the result or how the response was delivered securely.

That gap creates a better GRC conversation than "we take data protection seriously": can the business show its working when a customer, employee or former employee asks what information it holds?

Action window: test one request path this week. The ICO guidance says the normal response deadline is one month from receipt. It is updated guidance, not a consultation notice, and the page does not state a separate consultation deadline. 1

Key talking points

The ICO says the 16 July update reflects changes under the Data (Use and Access) Act 2025 and brings the brief guidance into line with its updated detailed right-of-access guidance. The page does not list every legal change, so the post should avoid inventing a new rule that the source does not state. 1
A subject access request can be made verbally or in writing, including through social media. The requester does not need to use a particular form of words, refer to legislation or contact a named person. That makes front-line recognition part of the control, not just the privacy team's job. 1
The ICO says organisations must respond without undue delay and within one month. An extension of up to two further months may be available when a request is complex or when the organisation has received several requests from the same person, but the requester must be told why within the first month. 1
The organisation must make a reasonable and proportionate search, provide the information clearly and accessibly, and take all reasonable steps to supply it securely. The source also says that an organisation may ask for clarification where it is reasonably required; the one-month clock can pause while the requester clarifies the request. 1
The ICO's checklist points to practical evidence: a way to record verbal requests, suitable information-management systems, trained staff, a search process, a complaints process and secure delivery in the right format. Those are useful SME control owners and audit prompts, not a requirement to buy a particular system. 1
A simple GRC translation is a five-part request record: receipt and route, identity or authority check, systems and owners searched, redactions or decisions with reasons, and secure delivery plus closure. Label this as a practical operating model rather than an ICO template.
The growth angle should stay precise. A prospect may not need to inspect an SME's internal systems, but it can reasonably ask whether the company can find, protect and explain the personal information it holds. A dated request record is stronger evidence than a generic assurance statement. The ICO guidance does not say that this process guarantees a complaint-free outcome.

Brief 2: Read the Cyber Security Bill as a supplier-assurance signal

Audience pain point

When a new cyber bill reaches the headlines, an SME can make one of two mistakes: ignore it because the business is not an essential service, or claim that every SME is about to face the same legal duty. The useful question is narrower: does the business provide a service that a regulated organisation depends on, and can it explain the risk if that service is disrupted?

That is a customer and growth question as much as a compliance question. A small provider may not be directly regulated, yet still face deeper due diligence from a hospital, utility, cloud customer or other organisation whose resilience depends on it.

Action window: use the 1 September 2026 committee-stage date as a calendar anchor for an internal scope and dependency review if the SME provides managed IT, cloud, data-centre, digital or critical-sector services. The date is a parliamentary milestone, not a compliance deadline. 2

Key talking points

Parliament's 15 July update says Lords members discussed the Bill's main principles at second reading on 14 July. It records committee stage as scheduled for 1 September 2026. The Bill is therefore an active legislative signal, not enacted law. 2
The Bill would amend the Network and Information Systems Regulations 2018. The government's summary says the regime does not cover the whole economy and currently concerns essential services and some digital services, including energy, transport, health, drinking water, digital infrastructure and certain online or cloud services. 4
The proposed expansion includes medium and large data centres, relevant managed service providers and large load controllers. The government also proposes powers for regulators to designate critical suppliers, recognising that a supplier's weakness can disrupt an essential or digital service. 4
That wording matters for SME marketing. It does not mean every small supplier is automatically in scope. It does mean an SME should know whether it is selling a managed service, supporting a service that may be designated critical, or simply supplying a product with no role in the customer's essential service. That classification needs evidence, not a badge or a guess.
The government summary describes proposed incident-reporting reforms: more harmful cyber breaches would need reporting, with an initial notification within 24 hours and a fuller report within 72 hours. It also says data centres and digital and managed service providers would need to inform customers if they are likely to have been affected. These are proposed reforms and depend on the Bill and later detail coming into force. 4
A practical SME evidence pack can answer five customer questions: what service do we provide, which customer operation depends on it, which sub-suppliers could interrupt it, who receives and sends incident notifications, and what recovery evidence can we share. This is a preparation exercise, not a claim that the Bill prescribes this exact pack.
The government's implementation note says reforms would come into force in phases after the Bill becomes an Act. Some measures would require secondary legislation, and the government says an adjustment period would be communicated before new or updated duties begin. 4
The growth angle is specific: a provider that can explain service dependencies, incident contacts and recovery evidence is easier for a regulated customer to assess. Do not promise that the Bill will win business or that a review today proves future compliance. The honest claim is that clear evidence shortens the conversation when a buyer asks where operational risk sits.