Data (Use and Access) Act 2025: new statutory rules on handling data protection complaints from 19th June 2026

Background and scope

The Data (Use and Access) Act 2025 ("DUAA") received Royal Assent on 19th June 2025 and its requirements are now being phased in.

New rules relating to the handling of data protection complaints are due to come into force on 19th June 2026. The new rules will apply to controllers only, and cover complaints by individuals relating to alleged failures to comply with the UK GDPR or with Part 3 of the Data Protection Act 2018.

The Information Commissioner’s Office (“ICO”) has set out guidance on the new requirements.  

Some of the key rules are summarised below.

Processes

Controllers must have clear and effective processes in place for handling data protection complaints from individuals, including to allow people to complain directly to them. Complaints must be accepted regardless of how they are submitted, including via social media. Controllers must ensure individuals are informed of their right to complain in privacy notices and when responding to requests to exercise data protection rights.

Timelines

Once a complaint is received, the controller must acknowledge it within 30 days. The statutory clock begins on the day after receipt, including where the complaint is received on a weekend or public holiday. The organisation must begin enquiring into the complaint without undue delay and must carry out an investigation that is reasonable and proportionate to the nature and complexity of the issues raised, and the impact on the individual.

Where an investigation is ongoing, the complainant must be kept informed of progress and any anticipated delays. The outcome of the complaint must be provided without undue delay, and cannot be withheld pending resolution of a wider complaint covering other matters.

Third party requests

In the case of complaints submitted by third parties on behalf of data subjects, organisations must verify that the third party is authorised to act before investigating the complaint. Where complaints involve children, organisations must assess whether the child has sufficient competence to exercise their rights and should ensure that communications directed to children are provided in clear, age‑appropriate language. Organisations in scope of the ICO Children’s Code should also ensure that they are familiar with the complaints-handling requirements set out in that document.

Practical steps for organisations

• Internal procedures and training: While there is no requirement to publish a data protection complaints policy, many organisations will need written internal procedures, supported by staff training, to ensure they can comply with the new rules.
• Privacy notices: Update privacy notices to clearly explain individuals’ right to complain to the organisation.
• Complaint records: Keep records of when complaints are received, how and when they are acknowledged, the steps taken during the investigation, and the final outcome (the ICO can request these records).
• Record-keeping system: Check that you have a clearly organised and labelled record‑keeping system in place so you can quickly locate the information needed to investigate complaints.
• Processor/joint controller arrangements: Consider whether arrangements with processors and joint controllers support the new regime, particularly where complaints may need to be escalated or investigated collaboratively.

How we can help

We have produced a detailed flyer on the new data protection complaints requirements, and associated ICO guidance. Please contact us if you would like to receive a copy, or if you need advice on these upcoming rules.

Article co-authored by Zahra Mahmood.