Search
The Information Commissioner’s Office (ICO) has issued guidance for meeting the new requirements for firms to have a data protection complaints process, as set out in the Data (Use and Access) Act. Although these requirements are not in force until 19 June 2026, the guidance has been published so that firms can be ready for these changes.
Firms must have a process for handling data protection complaints within their organisation; there are no exemptions to this. This guidance provides practical advice to help firms meet these legal obligations.
Data protection law says firms must:
• give people a way of making data protection complaints to you;
• acknowledge receipt of complaints within 30 days of receiving them;
• without undue delay, take appropriate steps to respond to complaints, including making appropriate enquiries, and keep people informed; and
• without undue delay, tell people the outcome of their complaints.
How to deal with data protection complaints | ICO
