About the consultation
-
This guidance explains what you need to do to meet the new requirements for you to have a data protection complaints process, as set out in the Data (Use and Access) Act. Although these requirements are not in force until 19 June 2026, we think it is useful for this to be published now so that you are ready for these changes. Even before these requirements are in force, we think that what’s set out in this guidance represents good practice.
About the consultation
The public consultation ran until 19 October 2025. We received 86 responses in total. This included 74 responses on our consultation platform and 12 email responses. Three of the 12 email responses provided answers to the questions in the consultation and are therefore included in the numerical analysis in this report. The remaining nine email responses have been considered only in the qualitative analysis.
We received a mix of responses set out below:
- Public sector: 28 responses (33%)
- Private sector: 30 responses (35%)
- Charity of non-profit: 19 responses (22%)
- An individual acting in a private capacity (eg someone providing their views as a member of the public): 5 responses (6%)
- Other: 4 responses (5%)
We thank everyone who took the time to comment and share their views.
Overall, the feedback was positive. Respondents welcomed the draft guidance and said the sections were clearly explained and well laid out. After reading the draft guidance, most respondents said they either understood, or partially understood, their obligations.
In analysing these responses we’ve identified several key themes. We’ve summarised these here.