New rules are now in force in relation to complaints under data protection law. Most organisations will already handle complaints in accordance with the new rules, but it's timely reminder to check your internal processes, particularly if your organisation is subject to a number of different regulatory obligations in relation to complaints.
What are the new rules on complaints?
The Data (Use and Access) Act 2025 has amended the Data Protection Act 2018 to introduce a new statutory right to complain to a controller where a data subject considers that there is an infringement of UK GDPR or Part 3 of the 2018 Act (which deals with processing for law enforcement purposes).
Organisations must:
- provide individuals with a way to make a complaint (for example an email address or online form)
- acknowledge complaints within 30 days
- investigate the complaint and provide a substantive response without undue delay
In our experience, many organisations will already do this, so in practice there is unlikely to be much change day to day. This is particularly so for businesses in regulated sectors such as financial services, utilities, or professional services, or public sector organisations.
As before, individuals also have a right to complain to the Information Commissioner.
While there is no requirement to do so, the ICO suggests that organisations may wish to adopt a complaints procedure explaining how data protection complaints are handled. This may be particularly helpful for organisations that are subject to general regulatory obligations in relation to complaints, as they can then explain how different types of complaints may be handled. In some cases, organisations may have more onerous obligations under those other regulatory obligations which will in practice require that organisation to provide a substantive response to a data protection complaint much quicker.
Organisations should also review their internal processes and policies to ensure that staff handle complaints in accordance with the new rules. This may require an initial triage stage to identify the subject matter of the complaint, whether it relates to the handling of personal data and how it should be dealt with.
More information
The new rules came into force on 19 June 2026. The ICO has published new guidance on data protection complaints to accompany the new rules.
If you would like to discuss the new rules or how your organisation handles data protection complaints, please contact Martin Sloan or your usual Brodies contact.
Contributor
Partner
