Organisations that process personal information must now give people a clear way to make a data protection complaint. They must acknowledge receipt of a complaint within 30 days, take appropriate steps to investigate it without undue delay, keep the complainant informed and communicate the outcome.
These requirements came into force on 19 June 2026. They were introduced by section 103 of the Data (Use and Access) Act 2025, which amended the Data Protection Act 2018.
These requirements also apply to small organisations. A business does not necessarily need to create a separate data protection complaints procedure if it already has a suitable complaints process. However, its process must allow it to recognise and handle data protection complaints in accordance with the new requirements.
What does this mean in practice?
Organisations must make appropriate enquiries into a complaint without undue delay, keep the complainant informed about the progress of the investigation and communicate the outcome without undue delay. The steps required will depend on the circumstances and complexity of the complaint.
Guidance is available on the Information Commissioner’s Office website, which small and medium-sized enterprises can refer to. This guidance suggests offering a way to contact your business via an online form that can be filled in and emailed or posted to you, providing a specific email address where complaints can be sent to, allowing complaints via phone or through a live chat option that can escalate to a human, or by providing a complaints portal online.
You don’t have to specifically have a portal like this, according to the ICO, but you need to have a clear way for complainants or their representatives to contact you.
Are there other ways people can complain?
Customers or their representatives can actually complain in any way they want to, which could even include speaking to a member of staff or contacting any part of your organisation. So, it’s important to ensure all your employees are well trained and understand that no matter who contacts them with a data protection complaint, it must always be passed on in a timely way.
If a complaint is made on social media, you would need to ask for a secure way to speak to the complainant, as it is not something you can ask them to discuss publicly. Children have the same rights over their data as adults, and they need specific protection, as they may not be aware of the risks of data processing in the way an adult might be. They need to also understand their rights when you process their personal information.
When dealing with a complaint from a child, organisations should use plain, clear language that the child can understand throughout the process. If someone submits a complaint on behalf of a child, the organisation should also check that the person is authorised to act for them, taking account of the child’s age, maturity and ability to understand their rights.
David Gomez, Senior Adviser on Ethics at the ICAEW, said: “The level of trust people have in a business is influenced by their perception of how you handle their data.
“Putting in place appropriate governance frameworks, having an accessible complaints process, and ensuring staff have the relevant training, all contribute to that trust, and are part of promoting an ethical culture within business.”
Important: This article is for general information only and does not constitute financial, investment, legal, tax, regulatory or insurance advice, or a recommendation of any product, provider or course of action. The information, figures, fees, interest rates, tax rules, allowances, legal requirements, products and account terms referred to were believed to be correct at the time of writing but may have changed since publication. Do not rely on this article as a statement of the current position. Always check the latest information with the relevant government department, regulator or provider and obtain appropriately qualified professional advice before taking or refraining from action.
We can help you meet your obligations
If you would like help reviewing your business processes and identifying where data protection responsibilities need to be incorporated, please contact us. For specialist advice on data protection law or a particular complaint, you should contact a suitably qualified data protection professional or solicitor.
Ready to Find Out How Financially Healthy Your Business Really Is?
Take our Business Health Check and discover the opportunities, risks and next steps that could help you build a stronger, more profitable and sustainable business.