Since 19 June 2026, every organisation that acts as a data controller in the UK has had a legal duty to handle data protection complaints. The duty sits in a new section 164A of the Data Protection Act 2018, inserted by the Data (Use and Access) Act 2025, and there is no exemption for small businesses. You must make it easy for people to complain, for example with a complaint form that can be completed electronically, acknowledge each complaint within 30 days, look into it and keep the person updated, and tell them the outcome without undue delay.
This guide is for business owners, office managers, data protection leads and anyone who deals with complaints. It covers what the law requires, how to recognise a data protection complaint, how to build a simple process and where training fits in.
What section 164A requires
The new duty applies to controllers. A controller is the organisation that decides why and how personal data is used. For most businesses, that means you. It covers complaints from data subjects who think you have breached the UK GDPR or the Data Protection Act 2018 in the way you handle their information.
The law sets out four things you must do:
- Make complaining easy. You must take steps to help people complain. The Act gives the example of a complaint form that can be completed electronically, while still accepting complaints made by other routes such as post, phone or in person.
- Acknowledge within 30 days. You must confirm receipt of the complaint within 30 days of getting it.
- Look into it properly. You must take appropriate steps to respond without undue delay. This includes making enquiries into the subject matter and keeping the complainant informed of progress.
- Report the outcome. You must tell the complainant the outcome of the complaint without undue delay.
There is no fixed deadline for the final answer. The ICO describes undue delay as unjustified or excessive delay and expects organisations to judge it case by case. If an investigation takes longer than expected, tell the person why and when they can expect a reply.
Telling people they can complain
People need to know the route exists. Your privacy notice should explain that individuals can complain to you directly about how you use their personal data, and how to do it. The ICO also suggests mentioning the right to complain when you respond to a subject access request.
In most cases the ICO now expects people to raise a complaint with the organisation first. If someone goes straight to the regulator, they will usually be told to come back to you.
You do not need a separate system. The ICO says data protection complaints can sit inside your existing complaints process, provided that process meets the new legal steps.
Spotting a data protection complaint
Most people will never use the words GDPR or data protection. A complaint may arrive as an angry email or a phone call to reception. Frontline staff need to recognise the signs and pass the matter on.
Common examples
- A customer says their details were sent to the wrong person or shown to someone else.
- Someone complains about marketing emails or calls after asking to be removed.
- A former employee says you have not answered their subject access request, or answered it late.
- Someone believes their data was affected by a security incident or lost device.
A complaint about a late or incomplete subject access request is a data protection complaint in its own right. Treat it as both. Keep working on the request and log the complaint so the 30-day acknowledgement clock is met.
Building a simple complaints process
A workable process needs an owner, a log and clear timescales.
Ownership
Name one person or role who owns data protection complaints. In a smaller business this might be the office manager or a director. Make sure someone covers holidays and absence.
Logging and timescales
Record each complaint on the day it arrives. Note the date received, the date you acknowledged it, what you checked, conversations held, the outcome and any action taken. The ICO recommends keeping records of this kind, and they help if the person later takes the matter to the regulator.
Investigating and responding
Gather the facts, compare the complaint against the records you hold and check whether your own policies were followed. If the complaint is unclear, ask the person what outcome they are looking for. When you reply, explain what you found, what you have done and, where you think you complied with the law, why. Tell them they can contact the ICO if they remain unhappy.
Our complaints handling course covers the wider skills of receiving, investigating and closing complaints, which apply directly to this new duty.
Where training fits in
The ICO says staff should be able to recognise a complaint and know where to send it, and that this should form part of data protection training.
Annual refresher training is a practical way to keep the new duty in front of staff alongside cyber security and breach reporting. Our earlier article on annual GDPR refresher and cyber security training explains how to plan this, and the GDPR Refresher and Cyber Security Awareness course is built for that yearly update.
GDPR & Data Protection Training
This online course explains the UK GDPR principles, individual rights, breach reporting and how staff should handle personal data day to day. It suits all employees who handle personal information and is NFAQ certified.
Frequently asked questions
Does the complaints duty apply to small businesses?
Yes. Section 164A applies to all controllers and has no small business exemption. A sole trader or small firm that decides how personal data is used must have a way to receive and deal with data protection complaints.
Do we need a separate complaints procedure for data protection?
No. The ICO says you can fold data protection complaints into your existing complaints process. That process must still make complaining easy, acknowledge complaints within 30 days and keep the complainant informed until you give the outcome.
When does the 30-day acknowledgement period start?
It runs from the day you receive the complaint. A complaint made to any member of staff counts as received, which is why frontline teams need to know how to recognise one and pass it on quickly.
Can someone still complain to the ICO?
Yes, people keep the right to complain to the ICO. In most cases the ICO will expect them to raise the matter with you first, so a clear and prompt internal process reduces the chance of regulator involvement.
This article was published in November 2026 by National Compliance Training. Regulations change, so always check the latest guidance from the ICO for the current position. This article does not constitute legal advice.