Section 164A of the Data Protection Act 2018

What the section says

Section 164A sits in the Data Protection Act 2018. It was inserted by section 103 of the Data (Use and Access) Act 2025 and comes into force on 19 June 2026. It creates a defined set of duties for controllers when people raise data protection complaints.

A controller is the organisation that decides why and how personal data is used. Section 164A applies to every controller regardless of size, sector or processing activity. There is no small business exemption. A small office can use a simple process, but it must still perform every required step.

The section is about access to a complaints route, acknowledgement, response, communication and evidence. It does not require a particular product. The ICO has said that a separate form or complaints tool is not required and existing means can be adapted.

Where Section 164A came from

The Data (Use and Access) Act 2025 inserted the section into the Data Protection Act 2018. The relevant insertion is made by section 103 of the 2025 Act. The complaints duties take effect from 19 June 2026.

This matters when writing policies and staff instructions. Refer to Section 164A of the Data Protection Act 2018 as the operative complaints provision. Refer to the Data (Use and Access) Act 2025 when explaining how it was introduced. The DUAA complaints requirements guide puts that change into practical context.

Duty by duty

Facilitating complaints

Controllers must give people a way to make data protection complaints. A complaint must be accepted however it is submitted, including through social media, and it can be made to any member of staff. A person should not lose access to the process because they used a channel you did not prefer.

The ICO has said that a separate form or tool is not required. Existing contact methods can be adapted. The practical test is whether staff recognise complaints and move them into a reliable process. If you publish a website complaint form, keep other routes open as well.

People must be told about their right to complain in privacy notices. They must also be told about that right when the controller responds to a subject access request. In both settings, provide the ICO's contact details.

Acknowledging within 30 days

Controllers must acknowledge receipt within 30 days. The acknowledgement confirms that the complaint has arrived. It does not complete the response and does not remove the other duties. Record how and when the acknowledgement was made.

For a complaint submitted by email, the ICO has said an automated electronic acknowledgement is sufficient. That makes automation useful, but it must connect to a record and a person responsible for the next step. Complaints received through other channels need an acknowledgement too.

Appropriate steps to respond

Without undue delay, the controller must take appropriate steps to respond. These steps include making appropriate enquiries. The words allow the work to reflect the complaint, but they do not permit inactivity. Identify the concern, make relevant enquiries and record what was done.

The controller must also keep the person informed without undue delay. Updates are part of the duty, not an optional customer service extra. A clear complaint handling process should assign ownership for enquiries and communication.

Informing the complainant of the outcome

The controller must tell the person the outcome without undue delay. The response should address the complaint in plain language and reflect the enquiries made. Record the outcome and when it was communicated.

The duties to acknowledge, investigate, update and give an outcome are connected but separate. Meeting the 30 day acknowledgement requirement does not show that appropriate enquiries happened. A complete record should make each stage visible.

The records Section 164A requires

Controllers must keep records of when complaints were received, how and when they were acknowledged, the steps taken to investigate, and the outcome. The ICO can ask to see these records. The complaint log guide explains how to keep one joined history for each matter.

The record should work across channels. If a complaint begins on social media and continues by email, both parts belong to the same history. If several staff members make enquiries, their actions should be recorded clearly enough for another person to follow.

How the ICO looks at it

The ICO guidance on dealing with data protection complaints is dated 12 February 2026. It explains that existing complaint routes can be adapted, automated electronic acknowledgements can be sufficient for email complaints, and complaints must be accepted however they are submitted.

The ICO has also said it will use complaint volumes and trends to identify potential compliance issues and decide whether to intervene with individual organisations. Reliable records therefore support both individual complaint handling and an accurate view of patterns.

A practical 164A compliance check

• Can every member of staff recognise and route a complaint?
• Can complaints from every channel enter one process?
• Is receipt acknowledged within 30 days and recorded?
• Are appropriate enquiries and updates recorded without undue delay?
• Is the outcome communicated and preserved?
• Do privacy notices and subject access responses explain the right to complain and give the ICO's contact details?

If any answer is unclear, fix the process before relying on the document. Compliance is shown by what happens to a complaint from receipt to outcome, supported by the record created along the way.

Handle this automatically with PrivacyComplaints.