The data protection complaints duty: why the problem is operational, not legal
October 2026. For DPOs, complaints managers and registrars.
Since 19 June 2026, every UK controller has had to run a data protection complaints process. Section 164A of the Data Protection Act 2018, inserted by the Data (Use and Access) Act 2025, has no size threshold and no sector exemption. Four months in, most organisations I speak to have the policy. Far fewer have a process that would work on a Tuesday afternoon when the complaint arrives in the wrong inbox.
What the law requires
The duty itself is short. A controller must give people a way to make a data protection complaint. It must acknowledge each complaint within 30 days. It must take appropriate steps to respond without undue delay, including making enquiries and keeping the complainant informed. And it must tell them the outcome, again without undue delay.
The ICO's final guidance, published on 12 February 2026, fills in the detail. Three points catch organisations out.
- The 30 days start the day after receipt. A complaint received on a Thursday starts its clock on the Friday. Holidays and staff absence don't pause it, so cover arrangements need to exist before the summer.
- Investigation starts on receipt, not on acknowledgement. The 30 days are a ceiling for acknowledging, not a waiting period. If you resolve a complaint within 30 days, a separate acknowledgement isn't needed.
- A complaint doesn't need to use the right words. If someone believes their personal data has been mishandled and says so, that is a data protection complaint, whatever channel it arrives through.
Where processes fail
In eight years of running complaints and appeals functions, I learned that procedures rarely fail at the investigation stage. They fail at the front door. Three failure points come up repeatedly.
Recognition
A student writes to a faculty office asking why their tutor knew about their disability. A parent emails reception asking who saw a safeguarding note. Neither mentions data protection. Both are data protection complaints, and neither will reach the right person unless front-line staff can spot them.
Triage
A single email can be a subject access request, a complaint about how the last request was handled, and a breach report at once. Organisations that route by category often handle the request and lose the complaint. A triage step that separates the strands, while handling all of them, prevents this.
Independence
The person best placed to answer a complaint about a team's handling of data is often a member of that team. That is also the person whose conclusions will be least trusted. Complaints need an investigator who sits outside the processing complained about, even in small organisations.
What a working process looks like
A process that will stand up has five components:
- A published route that accepts complaints in writing, by phone or in person, with reasonable adjustments and a way to complain on someone's behalf.
- A one-page quick reference for front-line staff, built on real examples of how complaints arrive in everyday language.
- A triage step that separates complaints from rights requests and breach reports.
- A register recording the date received, the acknowledgement, actions taken and the outcome, with reasons. The ICO also suggests tracking volumes and recurring themes.
- Signposting in privacy notices, rights responses and the general complaints policy, so people can find the route when they need it.
None of this is legally complicated. It is complaints management, and organisations that already run a good complaints function have most of what they need. The work is connecting it to data protection.
Where to start
Test your process the way a complainant would meet it. Send a complaint in everyday language through a general channel and see where it lands, how long it takes to be recognised, and whether the acknowledgement arrives in time. The result will tell you more than a policy review.
If you want a structured starting point, the free readiness check scores your position across five areas in about ten minutes.