New duty to handle data protection complaints

Background

On 19 June 2026, new provisions in the Data (Use and Access) Act 2025 came into force requiring organisations, including employers, to operate a formal process for handling data protection complaints.

While employers were already required to comply with data protection legislation and respond to requests such as subject access requests, they were not previously under a specific statutory duty to operate an internal data protection complaints procedure.

The new requirements

The new statutory complaints process applies to anyone whose personal data an organisation processes, including employees. Individuals are now encouraged to raise concerns directly with an organisation before referring the matter to the ICO, although there is no formal requirement to do so. The guidance makes clear that they do not need to use legal terminology or expressly describe their concern as a "complaint". A simple statement such as, "I don't think you should be using my information in that way", may be enough to trigger an employer's obligations.

Employers must provide a way for employees and other individuals to make data protection complaints, acknowledge receipt within 30 days, investigate and respond without undue delay, keep complainants informed of progress where appropriate, and notify them of the outcome. The ICO also explains that organisations can incorporate these requirements into existing complaints procedures rather than creating a separate standalone process, provided the statutory obligations are met.

The guidance recommends training staff to recognise potential data protection complaints, as they may be raised through a variety of channels, including emails, telephone calls, social media or as part of wider workplace issues such as grievances.

Learning points for employers

Employers should review their existing procedures to ensure they can identify and deal with data protection complaints in accordance with the new statutory requirements. Managers and HR teams should understand that employees do not need to make a formal complaint or refer to data protection legislation before the employer's obligations are engaged. Appropriate training and clear internal procedures will help ensure complaints are identified promptly, investigated appropriately and responded to within the required timescales. 

We have developed a template data protection complaints policy and complaints form. For more information, please contract Mark Stevens in the Employment team.