The new data protection complaints duty: is your process compliant?

Since 19 June 2026, every organisation that controls personal data has had to run a formal process for data protection complaints. The requirement comes from section 103 of the Data (Use and Access) Act 2025, which added a new section 164A to the Data Protection Act 2018. There’s no exemption for small businesses.

Plenty of SMEs still haven’t caught up. If yours is one of them, here’s what the law requires and how to put it right quickly.

What the law requires

Section 164A sets out what a controller must do:

• make it easy to complain, for example by providing a complaint form that can be completed electronically and by other means
• acknowledge receipt within 30 days of receiving the complaint
• take appropriate steps to respond, without undue delay
• tell the complainant the outcome, without undue delay

The ICO’s guidance adds that the 30 days start the day after you receive the complaint, even if that’s a weekend or bank holiday. You should also tell people about their right to complain when you collect their data, for example in your privacy notice, and when you respond to a data rights request such as a subject access request.

The aim is for complaints to be dealt with by the organisation first, before they reach the ICO. The Act also allows the government to make regulations requiring organisations to report how many complaints they receive to the Information Commissioner, so it’s worth logging them properly from the start.

What counts as a data protection complaint

It’s broader than you might think. A complaint can be about how someone’s personal data has been collected, used, stored, retained, or kept accurate, and people won’t always use the words “data protection”. Equally, not every complaint that mentions personal data will be a data protection complaint, and where it’s unclear the ICO suggests asking the person early on. Remember the duty covers your own staff and job applicants too, not just customers.

A simple checklist

1. Set up an easy route to complain, such as an online form, with another way to do it for people who can’t or won’t use the form, such as email, phone, or post.
2. Update your privacy notice to explain the right to complain and how to do it.
3. Add the complaint route to your subject access request and other data rights responses.
4. Brief your staff so they recognise a data protection complaint, even when it arrives inside a general customer complaint or an HR grievance.
5. Build in an acknowledgement step that goes out well within 30 days.
6. Keep a log showing what was received, when, what you did, and the outcome. The ICO expects you to be able to justify how you handled each complaint.
7. Close the loop. Tell the complainant the outcome and that they can take it to the ICO if they’re unhappy.
8. Learn from patterns. Repeated complaints about the same thing point to a process that needs fixing.

How it fits with your ISO systems

If you hold ISO 9001, you already have a complaints process. The ICO says organisations can use existing complaint systems for data protection complaints, as long as they still meet their data protection obligations. Adding a data protection category, the 30-day acknowledgement, and the privacy notice wording may be all you need.

For ISO/IEC 27001:2022, the new duty belongs in your register of legal and regulatory requirements (Annex A control 5.31) and your privacy controls (5.34). Auditors will expect to see it there, and if you’ve extended your ISMS with ISO 27701, they’ll look for it in your privacy information management too.

CAW Consultancy can review your privacy notice, complaints procedure, and ISO records against the new duty. If you’d like the process online, our sister company CAW Digital builds paperless forms and logs for management systems. Call 01257 824481 or email Craig@cawconsultancy.co.uk.

This article is general guidance, not legal advice.

Related reading

• Data Breach Response: Your First 72 Hours Under GDPR
• Critical suppliers and the new UK cyber law: what small businesses in the supply chain should prepare
• Cybersecurity Basics for SMEs: What Every Small Business Needs

About the author

Craig Willetts, lead auditor with over 20 years’ experience across 20+ ISO standards and UK security schemes. I founded CAW Consultancy to help UK businesses get ready for ISO certification and accreditation, in plain English and without the jargon. My team prepares you for your audit, and your chosen certification body carries it out. Connect with me on LinkedIn or visit CAW Consultancy.