Are businesses ready for the UK's new data protection complaints regime?

Businesses handling personal data in the U.K. should consider how they will adapt to forthcoming changes to data protection complaints requirements. While complaints around data protection issues are not new, the introduction of a new statutory right under the Data (Use and Access) Act 2025 will place clearer obligations on businesses to directly address complaints before regulatory involvement becomes necessary. 

The new framework applies to complaints received by the controller on or after 19 June and effectively formalizes an internal complaint handling requirement within U.K. data protection law.

In practice, it means businesses will be expected to demonstrate that complaints have been properly acknowledged, investigated and internally responded to before a matter reaches the Information Commissioner's Office. Businesses that are unable to evidence a clear process may face greater regulatory scrutiny where complaints are escalated. 

Complaints can touch on a variety of data protection issues — from unwanted marketing and delays in responding to subject access requests to concerns about how personal data has been shared — and the new requirements will require a more consistent and recognizable approach to handling them.

Under the new provisions, businesses will be expected to put in place accessible processes for individuals to submit complaints. The law does not define how to do this; the business must determine the most suitable method for their operations. This could mean providing a complaint form, directing complaints to a specific email address or maintaining a complaints portal. 

Importantly, while a business may offer a certain method, it does not mean an individual must use that method, and the business is still required to accept and handle filed complaints in accordance with the new requirements.