Detailed ICO guidance has been finalised and published, explaining how the regulator expects all organisations to meet expectations when handling complaints about data protection, a new right given to individuals from 19th June 2026 (introduced by last year’s Data (Use and Access) Act 2025).
It is succinct and clear, structured under headings:
- What are data protection complaints?
- How do we prepare to handle data protection complaints?
- What do we do when we receive a complaint?
- What do we do after we’ve finished our investigation?
Overview: what is required by law and the ICO guidance
Organisations must have a process to handle and respond to complaints if someone considers that you have infringed data protection legislation.
The new guidance is clear that individuals aren’t expected to use legal terminology or quote applicable sections of the law, and that the responsibility rests upon the organisation to recognise that the compliant is related to use of personal data.
Organisations are required to
- acknowledge a complaint within 30 days
- “without undue delay“ take “appropriate steps” to respond
- which includes “making appropriate enquiries” and “keeping people informed”, and then
- “without undue delay” inform individuals of the complaint outcome
This gives considerable discretion to organisations about how complaints are handled.
While the guidance recommends having a formal complaints procedure, that is not a requirement. Any existing complaint process or procedure in operation might be adapted and used, and it does not have to be written.
Handling complaints
The new ICO guidance is ‘light touch’ when it comes to setting out requirements.
Organisations must make an appropriate level of enquiries. They must be able to justify why they handled a complaint in the way they did and keep the individual making the complaint updated on progress of the investigation.
But the ‘how’ and ‘what needs done’ has been left to the organisation itself to decide, keeping in mind they must be able to justify why they handled a complaint as they did.
There is additional, but very general, guidance, outlining what the ICO consider should be done.
Applying that optional guidance is not a requirement. However, keeping it in mind and pragmatic application of it will benefit organisations. There is an inherent risk individuals will be unhappy on receipt of a complaint outcome and ultimately escalate any complaint dispute to the regulator. At that point, when organisations can evidence following the ICO’s additional ‘good practice’ guidance when investigating and responding to complaints, they are in a stronger position.
Points to note
A few specifics in the new guidance to highlight in particular:
- Organisations receiving a complaint made on behalf of someone else are required to check that the third party is authorised to act on a complainant’s behalf
- The optional guidance makes additional recommendations for organisations handling “complaints from, or on behalf of, children” which will apply to schools, for example
- Organisations are required to ensure arrangements for continuing to handle data protection complaints are in place during times when there are closures or staff absences for certain periods of the year (e.g. school holiday closures)
- The guidance makes explicit mention of complaints received through social media (for example mentioning how, if a complaint is received in that way, the individual should be asked for an alternative contact method, given that social media may not be a secure way to send personal information in relation to the complaint). In practice, given how social media is widely used by individuals to share negative views or raise issues about organisations, this might prove to be a way in which high volumes of complaints are generated.
Essential action
- Before 19th June 2026, make sure your organisations’ privacy notices or policies tell individuals they have a right to complain directly to you about use of their personal data
- Create an internal complaints process (if not already one in place)
- Make sure whoever is responsible for monitoring social media about your organisation is aware the law has created a new ‘right to complain’ about data protection issues and ensure they can identify complaints that need actioned.
Join our free webinar at 10am on Monday, 16 March for a closer look at the new ICO guidance on handling data protection complaints, with time for your questions. You can book your place here.