Section 164A of the Data Protection Act 2018
In short
Placeholder 40 word summary answering what Section 164A requires: controllers must let people complain about data protection, acknowledge within 30 days, take appropriate steps to investigate, and report the outcome.
What the section says
Placeholder copy.
Duty by duty
Facilitating complaints
Placeholder copy.
Acknowledging within 30 days
Placeholder copy.
Appropriate steps to respond
Placeholder copy.
Informing the complainant of the outcome
Placeholder copy.
How the ICO looks at it
Placeholder copy referencing published ICO guidance by name.
Related guides
- What the Data (Use and Access) Act 2025 changed
How Section 164A got here and when it bites.
- Turn Section 164A into a working procedure
From statute to a process your team can run.
- Evidence your compliance with a complaint log
Showing the regulator you met each duty.
Common questions
- What is Section 164A?
- Placeholder answer.
- When did Section 164A come into force?
- Placeholder answer.
- Which organisations does it cover?
- Placeholder answer.
- What does 164A compliance look like?
- Placeholder answer.
- What can the ICO do if we get it wrong?
- Placeholder answer.
This is general information, not legal advice.