New data protection complaints procedure requirements

From 1 June 2026, under the UK’s Data (Use and Access) Act 2025 (DUAA), organisations will be legally required to have a publicly accessible process for handling data protection complaints made by data subjects.

The change gives individuals a straightforward way to raise concerns if they believe their personal data has been mishandled; for example, a suspected data breach, inappropriate use or retention of their data, or worries about automated decision‑making and AI.

Organisations should also have internal procedures for managing those complaints.

What the complaints process must include

Under the DUAA, your external process and internal procedure must:

• give people a way of making data protection complaints to you – examples include an online form or complaints portal,
• provide data subjects with information about how the complaint will be handled.
• clearly explain what information an individual needs to provide, such as proof of identity;
• acknowledge the complaint within 30 days;
• provide a response or request further information without undue delay;
• keep the individual regularly informed about the progress of the investigation; and
• issue a final outcome promptly.

The law allows individuals to raise complaints in many different ways, including informal ones. They are not obliged to use any form or portal that you provide. This means organisations should be alert to comments, messages, or interactions that might represent a complaint – even if the individual doesn’t label it as such.

Why this matters: mandatory first step before ICO involvement

Importantly, your organisation’s complaints process becomes the first mandatory step before an individual can escalate a concern to the Information Commissioner’s Office (ICO) about potential breaches of the UK GDPR, the Data Protection Act 2018, or the Privacy and Electronic Communications Regulations 2003. This puts additional weight on organisations to ensure their processes are robust, transparent and capable of resolving issues early.

Once a complaint has been acknowledged (and clarified where needed), the organisation must investigate the matter without undue delay, maintain open communication with the individual, and provide a clear and timely outcome.

The outcome should outline:

• how the investigation was carried out,
• what information was considered,
• the conclusion reached, and
• the reasoning behind it.

If the individual is still unhappy and approaches the ICO, your handling of the matter – including the clarity and fairness of your investigation – may be scrutinised.

Who must comply?

The DUAA requirements apply to all UK data controllers and non‑UK organisations if they fall under the UK GDPR, such as those offering goods or services to, or monitoring the behaviour of, individuals in the UK.

What should organisations do now?

To prepare for these obligations coming into force, organisations should consider taking the following steps:

1. Create or update your data protection complaints process and internal procedures

Ensure they meet all legal requirements and public-facing information is easy for people to find and use. Consider placing it prominently on your website and linking it through your privacy notices.

2. Strengthen your investigation processes

Your approach must withstand scrutiny if an individual later asks the ICO to review your handling of the complaint.

3. Assign responsibility

Identify a person or team to oversee complaints handling and ensure the process is followed consistently.

4. Train your staff

Make sure personnel can recognise a data protection complaint and know what to do if they receive one. You should include information about complaint handling in any internal data protection training you give your staff.

5. Review and update contracts with third parties

Ensure that agreements with third-party controllers and processors provide you with appropriate protection in relation to notification and assisting in the handling of complaints.

6. Keep thorough records

Maintain a log of:

• all complaints received
• how each was handled
• the outcome reached.

These records help ensure consistent decision‑making and may be requested by the ICO.

How we can help

Whether you are a UK or overseas organisation processing the personal data of UK citizens, our experts can assist with all of the above, including:

• supporting you in complying with the new complaints process requirements.
• advising you in relation to any complaints that you might receive from data subjects;
• assisting you if you are investigated by the Information Commissioners Office;
• helping you to develop, update or audit your existing privacy and data protection framework and support you in compliance with legislation;
• draft or review contracts with third party processors or controllers.
• assist in providing data protection training to your organisation.

Please get in touch with our specialist GDPR and data protection solicitors.

Our corporate & commercial team is rated by national legal guides The Legal 500 and Chambers UK. The department’s expert lawyers can help businesses big or small on a variety of commercial challenges that may arise.

Willans Data Protection Services provides organisations operating on a multi-national basis with UK and Article 27 Representative solutions, Data Protection Officer services and GDPR training solutions.