New rules under the UK Data (Use and Access) Act 2025require organisations to implement a formal process for handling dataprotection complaints from 19 June 2026. UK organisations need to implement internalprocesses to ensure data subjects can complain to the organisation first beforeescalating to the ICO. This includes providing a clear mechanism to raise a dataprotection complaint, acknowledging receipt, and investigating the complaint withoutundue delay.
It is essential to keep the complainant informed, and communicatethe outcome as soon as possible.
Jonathan Wright, partner, Hunton Andrews Kurth said: "Thenew framework applies to complaints received by the controller on or after 19June and effectively formalises an internal complaint handling requirementunder UK data protection law. From this date, businesses will be required toimplement a mechanism or procedure whereby individuals can make complaints tothem relating to the handling of their personal data.”
“In practice, this means businesses will need to establish acomplaints process and demonstrate that complaints have been properlyacknowledged, investigated, and responded to. Businesses will be expected toput in place accessible processes for individuals to facilitate the making ofcomplaints. Businesses have flexibility to determine the most suitable methodfor how complaints are submitted, but all complaints must be dealt with,regardless of the method used to submit them. A business will need to acknowledgecomplaints within 30 days and ensure appropriate enquiries and investigationsare carried out without undue delay. One of the key practical challenges isidentifying what constitutes a data protection complaint, which makes theimplementation of clear internal procedures and training essential.”
“With the implementation deadline approaching, businessesshould ensure they have appropriate complaints handling processes andprocedures in place, as a failure to do so may result in increased regulatoryscrutiny and potential enforcement action in cases of repeated or systemicnon-compliance."
