Data Protection Complaints: Important update
As of 19 June 2026, all businesses are required to have a process in place for handling data protection complaints.
This is an important change introduced by the Data (Use and Access) Act 2025 and applies to businesses of all sizes.
The new requirements are designed to ensure that individuals can raise concerns directly with organisations about how their personal data is being used or handled, the way the business has responded to a subject access request, or other rights request or the security measures you've used to store their information, before escalating matters to the Information Commissioner's Office.
From this date, organisations must provide a clear way for individuals to make a data protection complaint. They must acknowledge complaints within 30 days of receipt, take appropriate steps to investigate without undue delay, keep complainants informed and communicate the outcome of the complaint.
Many organisations will already have complaints procedures in place. However, businesses should not assume that their existing process automatically meets the new requirements.
We recommend organisations take some time to:
• review whether individuals have a clear route for raising data protection complaints;
• ensure responsibilities for handling complaints are clearly allocated;
• establish procedures for acknowledging complaints within the required timeframe;
• review investigation and escalation processes; and
• update staff training, internal guidance and your privacy policies where necessary.
A clear and effective complaints process can help organisations resolve concerns early, maintain customer trust and reduce the likelihood of regulatory involvement.
For support reviewing your data protection governance, complaints procedures or compliance framework, please get in touch with the Tend Legal team.
This article is for general information purposes only and is not advice on your specific situation, and does not constitute legal advice.
