Consumer rights weekly: a new complaints-process right is coming, and Visa is sending AI to the chargeback fight

A short one this week. The big regulators were quiet over the bank holiday weekend, but two structural changes are worth flagging early.

You're about to get a new right to a complaints process

The Data (Use and Access) Act 2025 (DUAA) became law on 19 June 2025 and the first wave of obligations falls due on 19 June 2026, six weeks from now.

The headline that affects everyone:

Every UK organisation that processes personal data must operate a formal complaints process by 19 June 2026.

That means a visible link from their privacy notice. An accessible electronic and written complaint form. A clear explanation of how they'll handle it.

In practice this is a small earthquake. Most companies do not have a complaints route that meets that spec. From 19 June, if a company won't tell you how to complain about how they're using your data, that's itself a breach you can take to the ICO.

We're updating EvenStance to flag organisations that look like they're going to fail this deadline, and to walk you through the ICO escalation if they do.

Visa is bringing AI to the chargeback fight

In April, Visa launched a set of AI tools to help issuers (the bank that gave you the card) handle chargeback disputes faster. Faster sounds good. But faster handling on the bank's side often means faster rejections of weak consumer claims.

The fix is the same as it's always been: a strong evidence pack and a clear citation of the law. For UK card purchases between £100 and £30,000, that almost always means Section 75 of the Consumer Credit Act 1974 alongside the Visa or Mastercard reason code.

If you're disputing a card transaction and the bank is rushing you, slow down, write it up properly, and let EvenStance build the pack.

The CMA has started fining companies that won't reply

The Competition and Markets Authority quietly fined a business over £470,000 for failing to respond to one of its information notices. There are 14 business-to-consumer investigations live, and more than 100 firms have had warning letters. Under the DMCC Act the CMA can fine up to 10% of global turnover.

Translation: when a regulator writes to a company and the company ignores it, that now costs real money.

It also matters for you because it tells you whether the company you're fighting respects regulators. Companies that ignore CMA letters tend to ignore yours too. If you can find evidence in our company report cards (or in the CMA's public register) that a firm has been warned, your escalation letter writes itself.

Subscription rules are running late

The DMCC Act's subscription-contract rules (easier cancellation, transparent renewal notices, a real cooling-off period for auto-renewals) were pencilled in for spring. They've slipped to autumn 2026.

Our take: don't wait. The Consumer Contracts Regulations 2013 already give you a 14-day cooling-off period on most online subscriptions, and most companies still don't honour it cleanly. Use the existing law now and we'll refresh the templates the moment the new rules commence.

Recalls worth knowing about

• GoodHome fridge-freezers (B&Q): models GHBI7030FFUK and GHBI5050FFUK, sold February 2022 to April 2026. Fire risk. Stop using and contact B&Q.
• Sertraline 100mg: a batch was packed with Citalopram 40mg by mistake. If you take Sertraline, check your pack against the recall notice on gov.uk.
• Asda fishcakes: 290g packs with use-by dates 1-5 May. Narrow window but worth a check.

What we're watching next week

• The motor finance redress scheme is still on track to start 30 June 2026, with the complaints pause lifting on 31 May. Four legal challenges are running but the FCA is defending. If you took out PCP or HP between April 2007 and November 2024, get your complaint in.
• The DUAA 19 June 2026 deadline.
• Any Friday afternoon FCA enforcement drops: that's where most of the real action lands.

Stand stronger. Frank, EvenStance.