From 19 June 2026, all organisations must have a process for handling data protection complaints. This means that you must
- give people a clear way to raise a data protection complaint
- acknowledge it within 30 days of receipt
- take appropriate steps to investigate and keep people informed
- tell the complainant of the outcome without undue delay
This guide explains what counts as a complaint, what you must do, and how to set up a compliant complaints process under the Data (Use and Access) Act 2025.
