What are data protection complaints?
-
This guidance explains what you need to do to meet the new requirements for you to have a data protection complaints process, as set out in the Data (Use and Access) Act. Although these requirements are not in force until 19 June 2026, we think it is useful for this to be published now so that you are ready for these changes. Even before these requirements are in force, we think that what’s set out in this guidance represents good practice.
Latest updates - 12 February 2026
12 February 2026 - this guidance was published
What are data protection complaints?
If someone considers that you've infringed data protection legislation because of the way you've handled their personal information (or the personal information of someone they're acting on behalf of), they can complain to you.
In order to complain, they don’t have to use legal terms or quote sections of the legislation.
For example, people may submit complaints about:
- the way you’ve responded to their subject access request (SAR), or other rights request;
- the security measures you’ve used to store their information (eg someone who has been impacted by a data breach, regardless of whether it’s reportable to us); or
- how you’ve collected or used their personal information (eg where you’ve stored it, how long you’ve kept it for, or its accuracy).
Sometimes people may complain about your service or other matters, whilst also exercising their data protection rights. This doesn’t count as a data protection complaint. For example:
- a person may acknowledge you responded to their subject access request on time, but express dissatisfaction that you didn’t expedite it;
- an employee may raise a grievance issue, and also request copies of their personal information; or
- a person may complain about a customer service issue, and also request that you delete their information.
If you’re not sure whether someone is making a data protection complaint, you should ask them to clarify.
Read this guide to ensure you’re familiar with what you must, should and could do.