Home
5
Services
5
Data Protection Complaints Procedure

Data Protection Complaints Procedure: Setup and Support

Since 19 June 2026, the Data (Use and Access) Act has required organisations to give people a clear way to complain about how their personal data is used, to acknowledge it and to respond within a set period. Most still have no procedure and no record. We build the whole thing: a published complaints route, internal workflow, response templates, staff briefing and an audit trail that shows the ICO you took it seriously.



Speak to an expert
01234 923643

Data protection expertise trusted by hundreds of organisations.

Get a Fast Data Protection Complaints Procedure Quote

The New Complaints Duty, in Plain Terms

The Data (Use and Access) Act 2025 commenced on 5 February 2026, and the data protection complaints duty took effect on 19 June 2026. It applies to organisations handling personal data, not just to large ones. In practice you need three things: a facility that makes it easy for a person to complain to you directly, acknowledgement of that complaint without undue delay, and a substantive response within the statutory period. The intent is that complaints get resolved by you first, rather than going straight to the regulator.

Build Your Complaints Procedure Today

Why an Informal Inbox Is Not a Procedure

Plenty of organisations assume their existing customer complaints process covers this. It rarely does. Data protection complaints have their own trigger points, their own timescales and their own escalation route to the ICO, and they frequently arrive mixed in with a subject access request or a breach notification. Without a defined path, complaints sit in a shared inbox until the deadline has already passed, which is exactly the pattern the ICO looks for when deciding whether a failure was systemic.

What You Get From Our Complaints Procedure Service

Compliant From Day One

Your procedure is written against the Data (Use and Access) Act duty and existing UK GDPR requirements, with the acknowledgement and response timescales built into the workflow rather than left to memory.

Templates for Every Common Complaint

Pre written, legally sound acknowledgement and response wording for the complaint types that actually come in, so your team is not drafting from scratch under time pressure.

A Defensible Audit Trail

A structured complaints log recording what was raised, when, who handled it, what was decided and when the person was told. If the ICO ever asks, the record answers for you.

Escalation Handled by a Named Expert

Complex or hostile complaints can be escalated to us directly. If a complaint turns into an ICO enquiry, you have someone who has handled them before responding on your behalf.

What We Build and Hand Over

We write the public facing complaints route and the wording for your privacy notice and website, build the internal triage and escalation workflow with named owners and clock start points, and provide acknowledgement and response templates for the common categories: marketing without consent, refused or late subject access requests, inaccurate data, excessive retention and unexpected data sharing. You also get a complaints log structured for reporting, and a short staff briefing so front line teams recognise a data protection complaint when it arrives.

Data Protection Complaints: Your Questions Answered

What is a data protection complaint?

It is a complaint from an individual about how your organisation has handled their personal data. Common examples include marketing they never consented to, a subject access request that was refused or answered late, inaccurate information you will not correct, data kept far longer than needed, or data shared with a third party they did not expect.

Do we legally need a data protection complaints procedure?

Yes. The Data (Use and Access) Act complaints duty came into force on 19 June 2026 and requires organisations to provide a facility for people to make data protection complaints, to acknowledge them and to respond within the prescribed period. Even before that duty, being able to demonstrate accountability under Article 5(2) of the UK GDPR effectively required a documented route.

How long do we have to respond to a data protection complaint?

You must acknowledge the complaint promptly and provide a substantive response within the statutory period set by the legislation. The practical risk is not the length of the window, it is that nobody notices the clock has started. That is why our workflow fixes the trigger point and the owner at the moment a complaint is logged.

What happens if we ignore a complaint?

The individual can escalate to the Information Commissioner’s Office, and a pattern of unanswered complaints is treated as evidence of a systemic accountability failure rather than a one off error. UK GDPR penalties run to the higher of 17.5 million pounds or four per cent of global annual turnover for the upper tier, and since the Data (Use and Access) Act the maximum PECR fine has risen from 500,000 pounds to the same 17.5 million pounds or four per cent, so marketing related complaints now carry materially more risk than they did.

Can a complaint and a subject access request arrive together?

Frequently, and they run on separate clocks. One letter can contain a subject access request, an objection to processing and a complaint about all of it. Our triage process separates the elements at the point of receipt so each one is answered within its own deadline.

Do we have to tell people how to complain to the ICO?

Your complaints information should make clear that the person can go to the ICO if they remain dissatisfied. Being transparent about that route does not increase your risk. Hiding it does, because it looks like obstruction if the complaint is ever reviewed.