New data protection complaints law now in force

• New legal duty now applies to all organisations handling personal data
• Clear complaints processes help resolve issues early and protect customer trust
• ICO ready to support businesses as new law takes effect

New legal requirements on how organisations handle data protection complaints are now in force, marking a significant change for businesses across the UK.

All organisations must now give people a clear way to raise a data protection complaint, acknowledge it within 30 days, investigate appropriately and communicate the outcome.

The Information Commissioner’s Office (ICO) says the focus is firmly on helping organisations embed good practice, rather than catching businesses out.

The ICO’s data protection complaints guidance has been designed to support organisations of all sizes. This is timely as ICO research reveals that more than two in three businesses aware of the Data (Use and Access) Act - which is an Act of Parliament that updates areas of data protection law – either don’t know or incorrectly think the law change doesn’t apply to them. The guidance sets out clear expectations as well as giving practical examples based on real complaints businesses regularly receive, such as subject access requests, inaccuracies in personal data and marketing concerns.

Emily Keaney, Deputy Commissioner, Regulatory Policy at the Information Commissioner’s Office, said:

This is about good data protection becoming business as usual. A clear and fair complaints process helps people get their issues resolved and helps organisations identify and fix problems early.

We recognise that some businesses, especially smaller ones, may still be adjusting. Our role is to support you; provide clarity and help you build complaints handling into your day‑to‑day operations.

Getting this right isn’t just about compliance – it’s about trust, transparency and good customer relationships.

Friday 19 June also marked the 12-month commencement of the Data (Use and Access) Act, which means that all outstanding provisions of the Act are now in force. Information about what this means for organisations and the public can be found on the ICO’s website.

The regulator says that organisations that handle complaints promptly and fairly are less likely to see issues escalate, benefiting both businesses and individuals.

Businesses are encouraged to continue using the ICO’s guidance and resources to review and refine their complaints processes as the new law beds in.