If your organisation handles personal data, you need to be prepared for the possibility that someone will complain about how you've used it. Under the Data (Use and Access) Act 2025, there are now formal, legally binding requirements for how you must handle those complaints. Here's what you need to know.
What Counts as a Data Protection Complaint?
A data protection complaint arises when someone believes you have infringed data protection legislation through the way you've handled their personal information. This could relate to how you responded to a subject access request (SAR), the security measures you've used to store their data, or how you've collected, retained, or used their information.
Importantly, people don't need to use legal language or cite specific legislation to make a valid complaint. However, not everything is a data protection complaint. If someone raises a general customer service grievance but also asks for their data, or acknowledges a timely SAR response but is unhappy with the speed — these are not data protection complaints. When in doubt, ask the individual to clarify.
Your Key Legal Obligations
The Act is clear: there are no exemptions to the requirement to have a complaints process in place. At a minimum, you must:
- Provide a way for people to complain to you about their data
- Acknowledge complaints within 30 days of receiving them
- Investigate without undue delay, making appropriate enquiries proportionate to the circumstances
- Keep complainants informed throughout the process
- Communicate the outcome without undue delay
Handling Complaints in Practice
When a complaint arrives, acknowledge receipt of it promptly. Your investigation should begin immediately (not after the 30-day acknowledgement window), and you should consider the complexity of the issue, its scale, and any harm the individual may be experiencing.
Good record-keeping is essential. Log the date received, your acknowledgement, any relevant communications, and the outcome. This protects you if the ICO ever comes knocking.
Don't Wait — Act Now
The new requirements came into force on 19 June 2026. Getting your complaints process in order will not only keep you compliant but will also build trust with the people whose data you hold.
Update your website's privacy policy to include the right to complain to remain compliant with the new Act.
For full guidance, visit the ICO website.