Your data protection complaint handling process

Why you need a written process

From 19 June 2026, Section 164A of the Data Protection Act 2018 sets a minimum process for data protection complaints. Section 164A was inserted by section 103 of the Data (Use and Access) Act 2025. It applies to every controller. A controller is the organisation that decides why and how personal data is used. Size, sector and the type of processing do not create an exemption.

A written process turns the legal duties into actions that staff can repeat. It should not assume that every complaint arrives in a dedicated inbox. A person may complain by email, through a website form, on social media or to any member of staff. Your process needs one route for bringing all of those complaints into the same system.

Good complaint handling is visible. At any point, someone responsible for the work should be able to see when the complaint arrived, whether it was acknowledged, what enquiries have been made, what the person has been told and what happens next. That visibility also creates the records the ICO can ask to inspect.

Stage one: intake

Start by making complaints easy to recognise and route. Tell staff that a person does not need to use the word complaint or quote a law. If a message expresses concern about how personal data has been handled, send it to the person who owns the complaints process. Do not turn it away because it reached the wrong colleague or channel.

Record the date and channel of receipt immediately. Add the complainant's contact details, a short description of the concern and the staff member responsible for the next action. Preserve the original message. If the complaint was spoken, record what the person said in neutral language. The data protection complaint log guideexplains how to organise this record.

Your privacy notices must tell people about their right to complain and give the ICO's contact details. The same information must be given when you respond to a subject access request. Check that these routes point people towards contact methods your staff monitor.

Stage two: acknowledgement

Acknowledge receipt within 30 days. The acknowledgement confirms that the complaint has entered your process. It is not the outcome and it does not replace an investigation. For a complaint submitted by email, the ICO has said an automated electronic acknowledgement is sufficient.

The process should name who checks that an acknowledgement was sent and where that fact is recorded. An autoresponder may show that an email was received, but complaints arriving by other channels need the same control. Record how and when every acknowledgement was made. The free acknowledgement email wording gives staff a consistent starting point.

Stage three: investigation

Without undue delay, take appropriate steps to respond. Those steps include making appropriate enquiries. What is appropriate depends on the concern in front of you. A useful process tells the owner to identify the issue, find the relevant people and records, note each enquiry and keep an open record of what has been established.

Keep the person informed while the work continues. Silence makes it harder for them to know whether their complaint is being handled. Record each update alongside the investigation. If another colleague takes over, the record should let them understand the position without rebuilding the history from inboxes and messages.

Separate facts from assumptions. Record what the person says happened, what your enquiries show and any point that remains unresolved. This helps the final outcome address the actual concern. The practical step by step complaint guide follows one matter through these actions.

Stage four: outcome

Tell the person the outcome without undue delay. A clear outcome links back to the issues raised. Explain what enquiries were made, what was found and what the organisation has decided. Use ordinary language. Avoid unexplained internal terms or a long account that never answers the complaint.

The process should require the outcome date and method to be recorded. It should also make clear who approves the response and who sends it. Give the person the ICO's contact details where your process requires the right to complain to be explained. Do not describe the file as closed until the outcome has been communicated and recorded.

Stage five: records and review

Keep a joined record of when the complaint was received, how and when it was acknowledged, the steps taken to investigate and the outcome. The ICO can ask to see these records. A collection of separate emails is difficult to check and may omit complaints raised through other channels.

Review open complaints as part of normal work. Check that ownership is clear, the person is being kept informed and the next enquiry is recorded. Review closed records for completeness. The ICO has said it will use complaint volumes and trends to identify potential compliance issues and decide whether to intervene with individual organisations. A consistent process helps you see the same picture in your own records.

What good looks like is not a large policy. It is a reliable route from any channel to one record, with clear ownership at every stage. Use the guide to a website complaint form if a form would make intake easier, while remembering that people remain free to complain another way.