ICO issues updated data protection complaints guidance in advance of DUAA June in force date.
The ICO has published the final data protection complaints procedure guidance: How to deal with data protection complaints | ICO, which has been updated to reflect the changes coming into force under the Data (Use and Access) Act (DUAA). Under the DUAA, organisations must have a clear and accessible process for handling data protection complaints by 19 June 2026. A complaint can come from anyone who believes their personal information has been handled in a way that infringes data protection law and so having the right procedures in place is essential. This might be a good time for UK businesses to review their data protection complaints procedures and processes now the ICO guidance has been finalised and published in advance of the June in force date.
The DUAA introduces the following provisions that organisations must have in place in respect of data protection complaints:
- a new requirement for all organisations to have a data protection complaints process in place by the in force date;
- individuals must be provided with a clear mechanism for submitting data protection complaints;
- complaints must be acknowledged within 30 days of receiving them;
- “without undue delay” - take appropriate steps to investigate complaints (including making appropriate enquiries and keeping people informed); and
- inform individuals of outcomes without undue delay.
The new guidance sets out what organisations must, should and could do to comply with the changes to the law and it includes practical tips and advice for each stage of the process to help DPOs and organisations build a robust approach. It is helpful that the ICO has published this guidance in advance of the June in force date as it gives organisations ample opportunity to identify any gaps in their complaints processes, staff training or record keeping and prepare for compliance. We will continue to monitor the last tranche of the DUAA reforms when they come into effect, including the data protection complaints provisions; in the meantime, see our note on the latest DUAA provisions that came into effect earlier this month: The Data (Use and Access) Act 2025: key reforms in force.
