Acknowledge the complaint
-
This guidance explains what you need to do to meet the new requirements for you to have a data protection complaints process, as set out in the Data (Use and Access) Act. Although these requirements are not in force until 19 June 2026, we think it is useful for this to be published now so that you are ready for these changes. Even before these requirements are in force, we think that what’s set out in this guidance represents good practice.
Acknowledge the complaint
Respondents were asked to what extent they agreed that this section clearly explains what we mean by ‘acknowledge’. They answered:
- Strongly agree: 20 (26%)
- Agree: 48 (62%)
- Disagree: 6 (8%)
- Strongly disagree: 1 (1%)
- Unsure / don’t know: 2 (3%)
Respondents were asked if they thought there was anything else we should include here. They answered:
- Yes: 24 (31%)
- No: 53 (69%)
Respondents asked for clearer guidance on acknowledging complaints, including:
- how to calculate 30 days;
- how this fits with the obligation to investigate without an undue delay;
- what an acknowledgement should include; and
- what format an acknowledgement should be in.
A small number of respondents thought that waiting 30 days to acknowledge a complaint is too long and could itself be an undue delay.
ICO response
We’ve clarified how to calculate 30 days. We’ve also made it clear that the obligation to investigate without an undue delay starts as soon as the complaint is received, not after the 30 days or after the acknowledgement is sent.
We’ve explained that if an organisation completes its investigation within 30 days, it doesn’t need to provide a separate acknowledgement and outcome.
In response to the request for more detail about how organisations should acknowledge complaints, we’ve highlighted that the key thing is making sure the complainant understands their complaint has been received and will be looked into.
We’ve clarified that organisations should take a sensible, common-sense approach to acknowledgements. For example, if an organisation needs to ask for ID or confirm authority, it’s unlikely it’ll then need to provide an additional acknowledgement. For verbal complaints, we’ve added steps which are likely to happen in practice.
We’ve also clarified that organisations can choose the acknowledgement method which works best for them, subject to the need to comply with equality legislation. Using the method the complainant used or requested is likely to be the most practical. This will also help make sure the acknowledgement is sent to the right person.
We’ve made it clearer that auto-acknowledgement emails are likely to be sufficient, and that the list we’ve provided isn’t mandatory or exhaustive.