Controllers processing personal data under the UK GDPR need to comply with the new data protection complaints regime which entered into force on 19 June 2026. That means making sure you have processes in place to:
- Ensure individuals have an easy, accessible way of complaining to you
-
Acknowledge complaints within 30 days of receiving them
-
Ensure you investigate complaints appropriately and without undue delay
-
Keep individuals informed of progress; and
-
Provide a clear, comprehensive response to the complaint without undue delay
If you are not there yet, don’t panic. Read more about complaints handling for organisations and download our checklist here. If you need more support, contact us and we will be happy to assist!