Lynn Wyeth takes a look at some recent FOI and Data Protection issues, and what they mean for practitioners.
DP Complaints
Data Protection Complaints – The Legal Process You Have to Follow
For years, organisations have been told that they should have a process for dealing with data protection complaints. That has now moved from good practice to a specific legal requirement.
The Data (Use and Access) Act 2025 (DUAA) inserted a new section (164A) into the Data Protection Act 2018, creating specific duties for controllers when someone complains about the way their personal data has been handled. The new complaints requirements came fully into force in June 2026.
What counts as a data protection complaint?
It is wider than someone writing an email headed “Data Protection Complaint”.
A complaint arises where someone considers that you have disregarded data protection law in connection with their personal data. They do not need to quote the UK GDPR or Data Protection Act or use any legal terminology.
It might be someone complaining about how you handled their Subject Access Request, how their information was shared, how long you kept it, its accuracy, or what happened following a personal data breach.
Staff therefore need to be able to recognise a data protection complaint, not simply look out for the word “complaint”. It needs to be dealt with in a different way to a normal corporate complaint, as its escalation process via the Information Commission (ICO) will be different to other complaints.
What do organisations have to do?
Firstly, you must make it straight forward for the complainant to submit their data protection complaint. People need a practical way of complaining to you. That could be an online form, email address, telephone route or an existing corporate complaints process.
Importantly, you cannot insist that someone uses your preferred form or procedure. If they complain to another part of the organisation – or potentially through social media – it can still be a valid complaint too.
You must then:
- acknowledge the complaint within 30 days of receiving it;
- make appropriate enquiries into it without undue delay;
- keep the complainant informed about progress; and
- tell the complainant the outcome without undue delay.
The 30 days is therefore an acknowledgement deadline, not a target for starting the investigation. The ICO makes it clear that your obligation to investigate begins when you receive the complaint.
What does “without undue delay” mean?
There isn’t a new fixed statutory deadline for completing every complaint.
What is reasonable will depend upon the circumstances and complexity of the case. But organisations cannot simply acknowledge a complaint and then allow it to disappear into the ether. If it is taking time, keep the person informed and explain what is happening.
What should organisations be doing now?
There are some obvious practical steps.
Check your privacy notices and rights-request responses. Make sure people are told that they can complain to you first (and then to the ICO if they remain unhappy).
Decide where data protection complaints will go internally and who will investigate them. Make sure frontline staff know how to recognise one and where to send it.
You should also keep proper records of complaints, investigations, outcomes and actions taken. Look at recurring themes as they may identify wider compliance problems before they become more serious.
The bigger picture
This is more than another policy to add to the intranet.
The intention is to encourage organisations to resolve data protection problems themselves before they reach the ICO. A good complaints process can identify mistakes, put things right quickly and hopefully prevent unnecessary escalation.
Learn more about the guidance, good practice and ‘gotchas’ of DP Complaints. Register for our DP Complaints webinar
