Since 19 June 2026, if someone complains about how you've used their personal information, you must make it easy to complain, acknowledge the complaint within 30 days, look into it without undue delay, and tell them the outcome.
What the law now says
The Data (Use and Access) Act 2025 gave people a new right to complain directly to an organisation about how it uses their personal information. The rules came into force on 19 June 2026 and apply to every organisation that decides how personal data is used, including sole traders and small businesses.
What you must do
- Make it easy to complain. Accept complaints however they arrive, including email, phone, letter or social media.
- Tell people they can complain. Mention it in your privacy notice and in replies to requests about their data.
- Acknowledge within 30 days. The 30 days start the day after you receive the complaint, including weekends and bank holidays.
- Look into it without undue delay. Your investigation should be proportionate to the issue and its impact on the person.
- Keep them updated about progress and any delays, and tell them the outcome without undue delay.
- Keep records of each complaint: when it arrived, when you acknowledged it, what you did and the outcome. The ICO can ask to see them.
What this means in practice
For most small businesses, a short written procedure, one named person responsible, and a simple log are enough. Aim to acknowledge complaints within a few working days, well inside the 30-day limit, and fix the cause if you got something wrong.
People can still complain to the ICO if they're unhappy with your response, so handling complaints well yourself is the best way to keep things simple.
Get it done
The compliance pack in our readiness report includes a data protection complaints procedure with a complaints log, plus a privacy notice that already explains how to complain, both written for your business.
Common questions
When did the new complaints rules start?
On 19 June 2026, under the Data (Use and Access) Act 2025.
How quickly must I acknowledge a data protection complaint?
Within 30 days, starting the day after you receive it.
Do the rules apply to small businesses?
Yes. They apply to every organisation that decides how personal data is used, whatever its size.
Sources
- CMS: New statutory rules on handling data protection complaints
- Osborne Clarke: ICO explains the new complaints requirements
This guide is general information, not legal advice. Fees and rules can change, so check the sources before you rely on them.