DUAA and Pension Schemes: Updates to Complaints Handling

From 19 June 2026, the Data (Use and Access) Act 2025 (“DUAA”) introduced a new complaints framework for personal data matters. Although the DUAA is not pensions-specific, it is highly relevant to pension schemes, including in the public sector, where large volumes of member data may be held across multiple employers and complex administration projects. Scheme managers, administering authorities and trustees acting as data controllers must now have a formal process for handling data protection complaints from members and other individuals.

New Statutory “Right to Complain”

The DUAA gives individuals a clear statutory right to complain directly to organisations, including pension schemes and their governing or administering bodies, about how their personal data is handled. This means concerns about issues such as subject access requests, data accuracy or security will generally need to be raised with the scheme first, before being escalated to the Information Commissioner’s Office (ICO).

Mandatory Internal Complaints Process

The DUAA places a positive obligation on schemes, scheme managers, administering authorities and trustees to have, and follow, an internal process for handling data protection complaints.

As a minimum, schemes must:

• provide a clear and accessible route for complaints, such as an email address, form or other suitable channel;
• acknowledge complaints within 30 days;
• investigate and respond without undue delay; and
• explain the outcome clearly, including any remedial action taken or proposed.

Individuals should also be told about the process and their rights in a clear and accessible way.

Interaction with IDRP

For pension schemes, a key question is how the new DUAA complaints process sits alongside existing Internal Dispute Resolution Procedure (IDRP) requirements, and whether current IDRP arrangements are sufficient.

Schemes may choose to align the two processes, but the requirements remain distinct. In particular, data protection complaints are escalated to the Information Commissioner’s Office (ICO), whereas non-data-related IDRP complaints are generally escalated to the Pensions Ombudsman. Additionally, the timing expectations also differ as whilst the DUAA requires complaints to be handled “without undue delay”, this is likely to be more demanding than typical IDRP timescales.

Schemes should therefore identify data protection complaints at an early stage and track them separately, even where the DUAA and IDRP processes are aligned.

Consequences for Pension Schemes

The DUAA may increase complaint volumes, as individuals are encouraged to raise data protection concerns directly with schemes. It may also mean that a broader range of communications, including informal or misdirected queries, need to be identified and treated as complaints. This could be particularly important for public sector schemes, where administrators may receive member queries through multiple channels and from large membership populations.

Practical Steps for Schemes

Scheme managers, administering authorities and trustees should consider:

• reviewing and updating complaints procedures to ensure they meet the DUAA requirements;
• deciding how data protection complaints will interact with IDRP, whether as an integrated or standalone process;
• updating privacy notices and member communications to explain the new right to complain;
• training administrators and advisers to identify, escalate and respond to data protection complaints promptly; and
• keeping clear records of complaints, investigations, outcomes and any remedial action.

Conclusion

The DUAA is more than a technical update to data protection law. For public sector pension schemes, it creates a parallel complaints process with its own procedural requirements and regulatory oversight. Schemes that review their arrangements now and align clear processes with existing governance frameworks will be better placed to manage risk, respond consistently and support member confidence.

If you would like to discuss anything raised in this blog in more detail, please get in touch with a member of the pensions team or your usual Brodies contact.