A new rule for organisations relating to data protection complaints, set out in the Data (Use and Access) Act 2025, came into force in June 2026. The requirement is straightforward but important: all organisations must now have a process in place for handling data protection complaints. There are no exemptions.
What the law now requires
Data protection law states that organisations must:
- Give people a way to make data protection complaints
- Acknowledge receipt of complaints within 30 days
- Take appropriate steps to respond without undue delay, including making necessary enquiries and keeping people informed
- Inform people of the outcome of their complaint without undue delay
What this means in practice
If someone believes you have breached data protection legislation in the way you have handled their personal information, or the personal information of someone they represent, they must be able to complain to you. They do not need to use legal language or refer to specific legislation. If there is any uncertainty about whether a complaint has been made, it is important to seek clarification.
Organisations should ensure there is a clear and accessible way for people to raise complaints. This could include an online or paper form, a dedicated email address, or a telephone process. The format is flexible, but it must be genuinely usable and accessible. Whatever method you choose, complaints must be accepted at this stage.
Timescales and responsibilities
You must acknowledge receipt of a complaint within 30 days. The 30-day period begins the day after the complaint is received, regardless of whether this falls on a weekend or public holiday. If the final day falls on a non-working day, you have until the next working day to issue the acknowledgement.
Once a complaint is received, you must begin investigating without undue delay. This means avoiding any unjustified or excessive delay. The responsibility to investigate starts immediately upon receipt of the complaint and does not depend on the 30-day acknowledgement period. You must also keep the complainant informed about the progress of your investigation.
After completing your enquiries, you must inform the complainant of the outcome within a reasonable timeframe. It is also good practice to review the complaint to identify any learning points and improvements that could help prevent similar issues in the future.
Next steps for organisations
As you implement these requirements, now is a good time to create or update your Complaints Policy. This will help ensure your process is clearly set out, consistent, and easy for both staff and service users to follow.
For full details, see the Information Commissioner’s Office guidance.
If you would like support with your data protection obligations, you can contact VODA’s Core Services Team on 0191 323 2040 or email development@voda.org.uk.
