One month to go: the UK’s Data (Use and Access) Act 2025 new data protection complaints regime

The UK’s Data (Use and Access) Act 2025 (DUAA) introduces significant reforms to the UK data protection framework, including a new statutory complaints regime that will materially affect how organisations handle data protection concerns raised by individuals. Its scope includes customer and business data access, the regulation of personal data processing, privacy and electronic communications, and the establishment of the new Information Commission, alongside broader measures relating to data-driven services across the UK economy.

Section 103 of the DUAA inserts a new Section 164A into the Data Protection Act 2018, creating a formal right for individuals to complain directly to an organisation before escalating matters to the Information Commissioner’s Office (ICO). These new requirements come into force on 19 June 2026 and apply to all organisations acting as data controllers under the UK GDPR. The changes are intended to strengthen accountability and encourage organisations to resolve complaints internally at an earlier stage. They also place new operational and procedural obligations on controllers, requiring organisations to implement clear complaint handling mechanisms, defined timelines, and transparent communications processes.

Importantly, the definition of a “data protection complaint” under the new regime is intentionally broad. It is not limited to formal data breaches or subject access disputes. Complaints may relate to:

1. How a data subject access request (DSAR) or other data rights request has been handled
2. The adequacy of security measures protecting personal data
3. The impact of a personal data breach
4. The way personal data has been collected, used, stored, retained, shared, or kept accurate
5. Any perceived failure to comply with obligations under the UK GDPR or Data Protection Act 2018

As a result, organisations should expect a wide range of privacy-related concerns to fall within scope of the new complaints process 

What organisation must have in place

Under the new Section 164A requirements, organisations must establish a clear and accessible mechanism for individuals to submit complaints. This means organisations must provide an accessible electronic complaints form and at least one alternative method (e.g. email or post). The route to complain must be accessible and clearly signposted.

Merely accepting complaints informally or responding to complaints on an ad hoc basis will not satisfy the statutory requirement. The legislation also introduces procedural obligations relating to how complaints are handled once received. 

Acknowledgement requirements

Organisations must acknowledge receipt of a complaint within 30 calendar days. The statutory timeframe begins on the day after the complaint is received. Acknowledgements should confirm that the complaint is being reviewed and explain the next steps in the process. 

Investigation obligations

Organisations must investigate complaints without undue delay. This requires organisations to take reasonable and proportionate steps to understand the substance of the complaint, gather relevant information, and make appropriate internal enquiries. The ICO’s guidance makes clear that organisations are expected to demonstrate an active and documented investigation process rather than a purely administrative response.

Communication with complainants

Organisations must keep complainants informed throughout the handling process. This includes:

• providing updates on expected response timelines
• explaining any delays where applicable
• communicating outcomes clearly and in plain language
• informing individuals of their right to escalate the matter to the ICO if they remain dissatisfied

These communication requirements reinforce the DUAA’s emphasis on transparency and accountability in complaint handling.

Updates to privacy notices and rights communications

The DUAA also introduces proactive transparency obligations. Privacy notices and data subject access request (DSAR) response letters must be updated to inform individuals of their right to complain directly to the organisation and their right to raise concerns with the ICO. This information must be provided from the point at which personal data is first collected, meaning organisations should review customer-facing privacy information, employee notices, website disclosures, and data rights correspondence before the June 2026 implementation date.

Preparing for 19 June 2026

The ICO published its guidance “How to deal with data protection complaints” in February 2026 and has indicated it represents good practice even before the requirements formally apply. Organisations that have not yet begun preparing are running short of time. The following steps should be completed before commencement:

• Conducting a gap analysis of existing complaints procedures, privacy governance frameworks, and data subject access request (DSAR) handling processes against the new statutory requirements
• Drafting or updating standalone data protection complaints policies covering complaint intake, triage, investigation, escalation, resolution, and recordkeeping requirements
• Communicating dedicated complaints channels, including a clearly signposted electronic complaints form linked directly from the organisation’s Privacy Policy and website footer
• Updating Privacy policies and related transparency notices to include a dedicated complaints section informing individuals of their right to complain directly to the organisation and their right to escalate concerns to the Information Commissioner’s Office (ICO) as the UK supervisory authority
• Reviewing and updating subject access request response templates and other data rights correspondence to reflect the new statutory complaints framework
• Documenting acknowledgement, investigation, escalation, and response workflows with clearly defined ownership across privacy, legal, customer support, HR, and operational teams
• Maintaining a formal complaints register capable of recording the complaint reference numbers, statutory deadlines, escalation status, investigation actions and complaint outcomes
• Assessing records management and governance practices to ensure complaints can be logged, monitored, tracked, and reported against statutory timelines and accountability requirements
• Reviewing contractual arrangements with processors, joint controllers, and wider group entities to ensure complaint-handling obligations, cooperation requirements, and response timelines can be met in practice
• Coordinating internally across group entities and business functions to ensure complaints are handled consistently and escalated appropriately where issues affect multiple jurisdictions or business units
• Training relevant staff, including privacy teams, customer support personnel, HR teams, and complaint handlers, on identifying complaints, recognising when related communications (such as DSARs or marketing objections) should be triaged into the complaints workflow and applying the organisation’s escalation and investigation procedures consistently
• Incorporating complaints trends, outcomes, and escalation metrics into wider data protection governance and senior management reporting processes
• Using the ICO Guidance dated 12 February 2026 as the primary operational reference point when designing and implementing complaint-handling procedures

While many organisations already operate general complaints procedures, the new requirements create a formal statutory framework with prescribed obligations, timelines, and transparency requirements specifically focused on data protection matters.

At HewardMills, we support organisations in building data protection complaints processes that are operationally sound and fully compliant with the DUAA and ICO expectations, from gap analysis and policy drafting through to staff training and documentation. To discuss your organisation’s readiness ahead of 19 June, contact our team.