“New data protection complaints law now in force” reports ICO

All organisations must now give people a clear way to raise a data protection complaint, acknowledge it within 30 days, investigate appropriately and communicate the outcome.

The ICO asserts that the focus is now firmly on helping organisations to embed good practice rather than catching businesses out.

The ICO’s data protection complaints guidance has been designed to support organisations of all sizes. This is timely as the latest ICO research reveals that more than two in every three businesses aware of the Data (Use and Access) Act 2025 – itself an Act of Parliament that updates areas of data protection law – either don’t know or incorrectly think the law change doesn’t apply to them.

The guidance sets out clear expectations as well as giving practical examples based on real complaints businesses regularly receive, such as subject access requests, inaccuracies in personal data and marketing concerns.

Business as usual

Emily Keaney, Deputy Commissioner for regulatory policy at the ICO, commented: “This is about good data protection becoming ‘business as usual’. A clear and fair complaints process helps people to have their issues resolved and helps organisations to identify and fix problems early.”

Keaney continued: “We recognise that some businesses, particularly so smaller ones, may still be adjusting. Our role is to support them by providing clarity and helping them to build complaints handling into day‑to‑day operations.”

Further, Keaney noted: “Making sure this is right isn’t just about compliance. It’s also about trust, transparency and good customer relationships.”

Commencement date

19 June marked the 12-month commencement of the Data (Use and Access) Act, which means that all outstanding provisions of the Act are now in force. Information about what this means for organisations and members of the general public is available on the ICO’s website.

Those organisations that handle complaints promptly and fairly are less likely to see issues escalate, benefiting both businesses and individuals alike. Businesses are encouraged to continue using the ICO’s guidance and resources to review and refine their complaints processes as the new law beds itself in.

*Further information is available online at www.ico.org.uk