ICO subject access guidance and the Cyber Security Bill: 2 UK SME GRC angles

Brief 1: Turn the ICO subject access update into an evidence test

Audience pain point

Key talking points

• The ICO says the 16 July update reflects changes under the Data (Use and Access) Act 2025 and brings the brief guidance into line with its updated detailed right-of-access guidance. The page does not list every legal change, so the post should avoid inventing a new rule that the source does not state. 1
• A subject access request can be made verbally or in writing, including through social media. The requester does not need to use a particular form of words, refer to legislation or contact a named person. That makes front-line recognition part of the control, not just the privacy team's job. 1
• The ICO says organisations must respond without undue delay and within one month. An extension of up to two further months may be available when a request is complex or when the organisation has received several requests from the same person, but the requester must be told why within the first month. 1
• The organisation must make a reasonable and proportionate search, provide the information clearly and accessibly, and take all reasonable steps to supply it securely. The source also says that an organisation may ask for clarification where it is reasonably required; the one-month clock can pause while the requester clarifies the request. 1
• The ICO's checklist points to practical evidence: a way to record verbal requests, suitable information-management systems, trained staff, a search process, a complaints process and secure delivery in the right format. Those are useful SME control owners and audit prompts, not a requirement to buy a particular system. 1
• A simple GRC translation is a five-part request record: receipt and route, identity or authority check, systems and owners searched, redactions or decisions with reasons, and secure delivery plus closure. Label this as a practical operating model rather than an ICO template.
• The growth angle should stay precise. A prospect may not need to inspect an SME's internal systems, but it can reasonably ask whether the company can find, protect and explain the personal information it holds. A dated request record is stronger evidence than a generic assurance statement. The ICO guidance does not say that this process guarantees a complaint-free outcome.

Suggested LinkedIn post structure

1. Hook: "A subject access request is a test of whether your business can find and protect what it holds."
2. Give the signal: Name the ICO's 16 July 2026 update and say that it reflects changes under the Data (Use and Access) Act 2025.
3. Make the rule concrete: Explain the one-month response clock and the fact that a request can arrive verbally or through social media.
4. Give the exercise: Ask readers to test one request route and record the receipt date, owner, search locations, decision log and secure delivery method.
5. Close on trust: "The useful evidence is not a privacy slogan. It is a process that another person can follow and review."

Brief 2: Read the Cyber Security Bill as a supplier-assurance signal

Audience pain point

Key talking points

• Parliament's 15 July update says Lords members discussed the Bill's main principles at second reading on 14 July. It records committee stage as scheduled for 1 September 2026. The Bill is therefore an active legislative signal, not enacted law. 2
• The Bill would amend the Network and Information Systems Regulations 2018. The government's summary says the regime does not cover the whole economy and currently concerns essential services and some digital services, including energy, transport, health, drinking water, digital infrastructure and certain online or cloud services. 4
• The proposed expansion includes medium and large data centres, relevant managed service providers and large load controllers. The government also proposes powers for regulators to designate critical suppliers, recognising that a supplier's weakness can disrupt an essential or digital service. 4
• That wording matters for SME marketing. It does not mean every small supplier is automatically in scope. It does mean an SME should know whether it is selling a managed service, supporting a service that may be designated critical, or simply supplying a product with no role in the customer's essential service. That classification needs evidence, not a badge or a guess.
• The government summary describes proposed incident-reporting reforms: more harmful cyber breaches would need reporting, with an initial notification within 24 hours and a fuller report within 72 hours. It also says data centres and digital and managed service providers would need to inform customers if they are likely to have been affected. These are proposed reforms and depend on the Bill and later detail coming into force. 4
• A practical SME evidence pack can answer five customer questions: what service do we provide, which customer operation depends on it, which sub-suppliers could interrupt it, who receives and sends incident notifications, and what recovery evidence can we share. This is a preparation exercise, not a claim that the Bill prescribes this exact pack.
• The government's implementation note says reforms would come into force in phases after the Bill becomes an Act. Some measures would require secondary legislation, and the government says an adjustment period would be communicated before new or updated duties begin. 4
• The growth angle is specific: a provider that can explain service dependencies, incident contacts and recovery evidence is easier for a regulated customer to assess. Do not promise that the Bill will win business or that a review today proves future compliance. The honest claim is that clear evidence shortens the conversation when a buyer asks where operational risk sits.

Suggested LinkedIn post structure

1. Hook: "The Cyber Security and Resilience Bill is not a blanket new rule for every UK SME. It is a signal about which suppliers customers will scrutinise."
2. Give the update: Mention the Lords second reading on 14 July, the Parliament update on 15 July and the 1 September committee stage.
3. Draw the boundary: Explain that the proposed regime targets essential and digital services, with planned additions such as medium and large managed service providers and designated critical suppliers.
4. Give the exercise: Ask readers to map one service, its customer dependency, its incident contacts, its sub-suppliers and the evidence they could share after disruption.
5. Close on growth: "The strongest answer to a resilience questionnaire is a clear map of what your service affects and what happens when it is unavailable."