Your data protection complaint log

Why the log matters

Section 164A of the Data Protection Act 2018 requires controllers to keep complaint records. The section was inserted by section 103 of the Data (Use and Access) Act 2025 and comes into force on 19 June 2026. The duty applies to every controller regardless of size, sector or processing activity.

The required record covers when a complaint was received, how and when it was acknowledged, the steps taken to investigate, and the outcome. The ICO can ask to see these records. A complaint log brings those points into one place so they can be followed without searching separate inboxes, messages and notes.

The log is not only a list of names and dates. It is the working history of each complaint. It should show what has happened and what needs to happen next. This helps a colleague continue the work if the original handler is absent and helps the organisation check that no stage has been missed.

A complaint can arrive through any channel, including social media, and can be made to any member of staff. Every route should feed the same log. The complaint handling process guide explains how that handover should work.

Fields to record

Receipt

Give each complaint a reference. Record the date received, the channel, the complainant's contact details and the staff member who first received it. Preserve the original words where possible. Add a short, neutral summary so another person can understand the concern quickly.

Ownership and status

Name the person responsible for the next action. Use a simple status that shows whether the complaint is new, being investigated, awaiting an action, ready for outcome or closed. Record the next action clearly. A status is useful only when it reflects the underlying history.

Acknowledgement

Record the date, time and method of acknowledgement. Section 164A requires acknowledgement within 30 days. The ICO has said an automated electronic acknowledgement is sufficient when a complaint was submitted by email. Keep evidence of the acknowledgement or a reliable reference to it.

Investigation steps

Record each appropriate enquiry, who made it, when it happened and what it established. Link or attach the relevant material. Separate what the complainant said, what your records show and any issue that remains unresolved. Record updates sent to the person because controllers must keep them informed without undue delay.

Outcome

Record the outcome, the date it was communicated and the method used. Keep the final wording. Check that it addresses the concerns identified at intake and reflects the enquiries in the record. Do not mark the matter closed before the outcome has been given without undue delay.

Related matters

If the message also contains a subject access request, record that as a separate workstream and link the records. A subject access request asks for access to personal data. It is not the same as a complaint. The guide to complaints and subject access requests explains why both need attention.

What the ICO can ask for

The ICO can ask to see complaint records. A useful export should present the history in date order and make the four required areas easy to identify: receipt, acknowledgement, investigation steps and outcome. Include enough context to connect each action to the relevant complaint.

The ICO has said it will use complaint volumes and trends to identify potential compliance issues and decide whether to intervene with individual organisations. Consistent categories can help your organisation see volumes and trends too. Keep labels plain and use them consistently. Do not allow a category to replace the detailed record.

Check completeness before producing records. A list of outcomes without enquiry notes is incomplete. An email acknowledgement without the original receipt date leaves the timing unclear. Notes of enquiries without evidence that the outcome was communicated leave the final duty unclear.

Retention and access

The legal facts supplied for this guide do not specify a retention period. [VERIFY: set and document the period for which your organisation will keep complaint records.] Apply the chosen period consistently and make sure staff understand when a record can be removed.

Limit access to people who need the record for complaint handling and oversight. The log may contain personal data and detailed correspondence. Keep the working record in an agreed location rather than copying it into personal files. [VERIFY: confirm the access and security controls appropriate to your organisation.]

The ICO has said a separate complaints tool is not required. Existing means can be adapted. A spreadsheet may work for a small volume if it captures every stage and is managed consistently. As volume or complexity grows, a structured system can reduce missed handovers and make an evidence pack easier to produce.

Check the log before closing a complaint

• The receipt date and channel are present.
• The concern is described in neutral language.
• Ownership and every material handover are clear.
• The acknowledgement method and date are recorded.
• Appropriate enquiries and updates are listed in order.
• The outcome and communication date are preserved.

Use the step by step complaint guide alongside the log. The process tells staff what to do. The log shows that it was done.

Handle this automatically with PrivacyComplaints.