UK data protection complaints handling for organisations

From 19 June 2026 all controllers processing personal data under UK GDPR must comply with new data protection complaints handling requirements. This mandate, driven by the Data (Use and Access) Act 2025 (DUAA), will affect organisations large and small.

The new regime moves to prioritise “local resolution first”, requiring controllers to attempt to resolve grievances directly with individuals. Strategic risk mitigation now requires organisations to move beyond ad hoc responses to a more considered approach.

This regime transforms complaints handling from a reactive task into a mandatory, compliance operations function. Controllers must audit existing frameworks to ensure they:

• Tell people how they can make a complaint
• Put in place a process which allows them to:
  • Acknowledge complaints within the required time frame
  • Effectively investigate the complaint without undue delay
  • Keep the individual informed
  • Provide a response to the complaint without undue delay

For practical guidance on the regime changes, you can watch our webinar here.

Who does this apply to? The “No Exemptions” approach

The obligation to maintain a data protection complaints process is universal. The ICO has explicitly stated there are no exemptions based on turnover, headcount, or sector. The mandate applies to:

• SMEs and large organisations
• Charities and non-profits
• Schools and educational institutions
• Employers
• Public authorities

What is a data protection complaint?

Under the new regime, a complaint is triggered when an individual considers you have infringed data protection law in how their personal data is or has been used. Triggers for complaints could include:

1. Suspected misuse of data:  Processing data in a manner the data subject did not expect or for which there is no legal basis.
2. Excessive retention or unlawful sharing:  holding data beyond the time needed for its lawful purpose or e.g. sharing without a valid legal basis.
3. Concerns regarding AI and Automated Decision-Making (ADM): e.g. where there has been a failure to ensure the individual has adequate information and opportunity to contest the decision.
4. Data breaches and DSAR failures: e.g. failure to respond to a DSAR within the required time frame.

Data protection complaints rarely arrive in isolation. They are frequently “bundled” with customer service grievances, refund requests, or employment disputes. A senior compliance director’s view from the bridge is that your intake teams must be trained to “unbundle” these issues. While the refund is handled by Finance, the data grievance must be separated out and dealt with in coordination with relevant departments e.g Marketing, HR, or Legal to ensure statutory requirements are met.

Responding to the complaint and the 30-Day rule 

The legislation has established procedural benchmarks that demand high levels of operational coordination.

• The 30-Day acknowledgment:  Controllers must acknowledge receipt of the complaint within 30 days of receipt.  Do not use this acknowledgment to commit to a premature resolution deadline, use it to manage expectations and provide a realistic timeline based on the complexity of the issue.
• Postal complaints:  For organisations operating remote offices or hybrid models, be aware that physical post can create a significant operational bottleneck that must be addressed through centralised mail scanning or redirected intake.
• Effective investigation: You must make appropriate enquiries to investigate the complaint without undue delay, this might involve speaking with staff, reviewing relevant documentation etc.
• Response timing:  The law requires a full response to the complaint “without undue delay,” The legislation also requires you to keep the individual informed of the progress of the complaint.

Updates to policies and procedures

Controllers must execute a comprehensive review of all public-facing and internal documentation to ensure compliance with the new regime, in particular:

• Privacy Notices:  These must be updated to signpost complaint routes.
• Data Subject Rights workflows:  Every right request response must explicitly mention the individual’s right to complain if they consider the response is not compliant.
• Intake channels:  Controllers must ensure that a complaint can easily be made by an individual – for example, if customer service chatbots and AI interfaces are used, they should be trained to recognize phrases beyond the word “complaint.” Triggers such as “Why are you still contacting me?”, “Where did you get my data?”, or “I want my data deleted” should be automatically flagged for the privacy team.
• Internal complaints procedure: This needs to align with requirements including timeframes, the need to verify identity and to verify the authority of third parties and provide for a review of the outcome of complaints to ensure lessons are learned.
• Complaints log: To record and monitor the progress of complaints

Practical implementation: Verification, training, and security

If it is necessary to carry out identity checks, these must be reasonable and proportionate. In terms of third party representatives, there is potentially a significant security risk. Controllers must verify the specific authority of any third party acting on behalf of an individual at the outset.

Staff training

Training must not be a one-size-fits-all exercise. We recommend a layered approach:

• High-level training (all staff):  Focusing on recognising and escalating potential data protection complaints even in the absence of legal terminology and ensuring staff understand complaints can be made in a number of different ways and must be dealt with however they are received.
• Enhanced training (privacy, legal, and frontline):  Deep-dive training on how to respond to complaints compliantly and in accordance with your organisation’s procedures.

Governance

Senior management must maintain oversight of complaint-handling trends. Recurring themes in complaints (e.g., marketing opt-out glitches) should trigger a wider review of the organisation’s privacy processes and technical and organisational measures.

Why the regulatory landscape has changed

The shift to mandatory internal complaints handling addresses three regulatory objectives:

1. Earlier dispute resolution:  Resolving issues at the source to prevent regulatory friction.
2. Operational accountability:  Forcing organisations to treat privacy concerns with the same operational rigor as financial or consumer complaints.
3. Reducing ICO pressure:  With the ICO receiving over 42,000 complaints annually, the “local resolution” is a strategic move to try to free up regulator resources.

The new regime is not merely a restatement of rights and organisations that fail to engage, risk direct regulatory intervention and reputational damage.