DUAA complaints requirements

What the Act changed

The relevant complaints change is precise. Section 103 of the Data (Use and Access) Act 2025 inserted Section 164A into the Data Protection Act 2018. Section 164A sets duties for controllers when a person makes a data protection complaint.

A controller is the organisation that decides why and how personal data is used. The duty applies regardless of size, sector or processing activity. There is no small business exemption. What can remain proportionate is the process itself. A small organisation may use familiar contact routes and a simple log, provided every duty is met.

Controllers must give people a way to complain. Complaints must be accepted however submitted, including through social media, and may be made to any member of staff. The ICO has said a separate form or complaints tool is not required. Existing means can be adapted.

Receipt must be acknowledged within 30 days. Without undue delay, the controller must take appropriate steps to respond, including making appropriate enquiries, and keep the person informed. It must also tell the person the outcome without undue delay.

The change also makes records central. Keep when the complaint was received, how and when it was acknowledged, the investigation steps and the outcome. The ICO can ask to see those records. The detailed Section 164A guide explains each duty separately.

Key dates

The Data (Use and Access) Act is dated 2025. The Section 164A complaints duties come into force on 19 June 2026. The ICO guidance on dealing with data protection complaints is dated 12 February 2026.

Use 19 June 2026 as the operational date for the process described here. Before that date, map every route by which a complaint might arrive. Make sure staff know where to send one and who owns the acknowledgement, enquiries, updates, outcome and record.

Why the route matters

The new duties place the controller's process at the centre of complaint handling. A person needs a working way to raise the concern directly with the organisation handling their data. That route must work even when the message reaches an unexpected channel or staff member.

Privacy notices must tell people about their right to complain and provide the ICO's contact details. Controllers must give the same information when responding to a subject access request. A subject access request asks for access to personal data. It is distinct from a complaint, although one message can contain both. The complaint and subject access request comparison explains how to separate them.

The ICO has said it will use complaint volumes and trends to identify potential compliance issues and decide whether to intervene with individual organisations. This makes consistent classification and records important. A complaint that remains in a private inbox cannot contribute to a reliable organisational picture.

Your readiness checklist

Map every intake channel

List shared and individual email accounts, website forms, telephone routes, social media and face-to-face contact. Decide how a complaint from each channel reaches the same owner and record. Do not force the person to resubmit it elsewhere.

Set acknowledgement controls

Make the 30 day acknowledgement requirement visible. The ICO has said an automated electronic acknowledgement is sufficient for an email complaint. Check that automation creates or connects to a record rather than ending the process.

Define investigation ownership

Name the role that coordinates appropriate enquiries and keeps the person informed without undue delay. Staff who hold relevant information should know how to return it to the complaint owner. Record every material step.

Prepare outcome wording

Use a structure that identifies the concern, summarises the enquiries and gives the outcome in plain language. The free complaint response templates provide a starting point that can be adapted.

Build the evidence record

Your data protection complaint log should show receipt, acknowledgement, investigation and outcome. Check it can include complaints from every channel and show one coherent history.

Update public information

Review privacy notices and the wording used in subject access responses. Both must tell people about their right to complain and give the ICO's contact details.

Readiness is not the same as buying a new tool. The ICO has said a separate tool is not required. The aim is a process that works consistently, produces the required records and can be understood by the people expected to run it.