What UK businesses must do about data protection complaints from 19 June 2026
Section 164A of the Data Protection Act 2018 creates a clear complaints duty for every controller. It was inserted by section 103 of the Data (Use and Access) Act 2025 and comes into force on 19 June 2026.
In short
From 19 June 2026, every controller must provide a way to complain, acknowledge complaints within 30 days, investigate and keep people informed without undue delay, report outcomes without undue delay, and maintain records that the ICO can inspect when required.
A new minimum standard for handling complaints
A data protection complaint is a concern about how an organisation has handled personal data. From 19 June 2026, Section 164A sets out what a controller must do when one arrives. The duty applies regardless of the organisation's size, sector or processing activity. There is no exemption for a small business.
You do not need a separate complaint form or a new complaints tool. The ICO has said that existing ways of getting in touch can be adapted. The important point is that the route works. A complaint may arrive through a shared inbox, a contact form, social media or a conversation with any member of staff. It must be accepted however it is submitted.
People must also be told about their right to complain. Put that information in your privacy notices. Include it again when you respond to a subject access request, which is a request from someone for access to their personal data. In both places, give the ICO's contact details.
The four duties in your data protection complaints procedure
Your process should make each duty visible and repeatable. Staff need to know where to send a complaint, who acknowledges it, who makes enquiries and where the final record is kept.
Duty 1
Give people a way to complain
Make it possible for people to complain about how you handle their personal data. Accept complaints through any channel, including social media and any member of staff.
Duty 2
Acknowledge within 30 days
Confirm that you have received the complaint within 30 days. An automated electronic acknowledgement is sufficient when the complaint is sent by email.
Duty 3
Respond without undue delay
Take appropriate steps to respond, including making appropriate enquiries. Keep the person informed while you deal with the complaint.
Duty 4
Tell them the outcome
Tell the person the outcome without undue delay. Keep a record of the complaint, its acknowledgement, your investigation steps and the outcome.
An autoresponder is not a compliance record
An automatic email can meet the acknowledgement requirement for a complaint submitted by email. It can tell the person that their message has arrived and give your team time to direct it to the right person. That is useful, but it records only one part of the process.
You must also keep when the complaint was received, how and when it was acknowledged, the steps taken to investigate, and the outcome. If the complaint arrived through social media or was made to a member of staff, it still needs to reach the same record. A mailbox alone will not give you a complete view when complaints arrive through several channels.
Keep the record current as work progresses. Record the enquiries made, keep the person informed without undue delay, then record the outcome when it is given. The ICO can ask to see these records. It has also said that complaint volumes and trends will help it identify possible compliance issues and decide whether to intervene with an individual organisation.
The practical aim is simple. One complaint should have one clear history from arrival to outcome, even when several people help to deal with it. The guide to setting up a data protection complaint log explains the fields that hold that history.
Practical guides for each part of the duty
Use these guides to check your process, prepare your records and give staff a clear route for every complaint.
- Build a data protection complaint handling process
What good looks like from intake to the final record.
- Handle a GDPR complaint step by step
Practical actions from arrival through to closure.
- Understand Section 164A of the DPA 2018
The duty, where it came from and who it binds.
- Understand the DUAA complaints requirements
The 2025 Act and the change taking effect in June 2026.
- Set up a data protection complaint log
The records to keep and what the ICO can ask to see.
- Add a GDPR complaint form to your website
What to collect and a form you can copy.
- Use the free data protection complaint templates
Policy, log, acknowledgement, outcome and privacy notice wording.
- Tell a complaint from a subject access request
The different duties and deadlines explained.
Common questions
Who has to follow the complaints duty?
- Every controller must follow it, regardless of size, sector or processing activity. There is no small business exemption.
How long do we have to acknowledge a complaint?
- You must acknowledge receipt within 30 days. An automated electronic acknowledgement is sufficient when a complaint arrives by email.
Do we need a separate complaint form?
- No. The ICO has said that a separate form or complaints tool is not required. You can adapt the ways people already contact you, but you must accept complaints however they are submitted.
What records must we keep?
- Keep when each complaint arrived, how and when you acknowledged it, the steps taken to investigate, and the outcome. The ICO can ask to see these records.
This site provides general information about UK data protection law. It is not legal advice.