What must you do when someone complains about how you used their data?
Since 2026-06-19 every controller must have a process for data protection complaints: make it easy to complain, for example with an electronic form, acknowledge each complaint within 30 days, investigate without undue delay and tell the person the outcome. The regulator expects people to complain to you first.
What it is
Section 164A of the DPA 2018, inserted by the DUAA 2025, gives people a right to complain to the controller if they think it has infringed the UK GDPR or Part 3 of the Act. It sits alongside the right to complain to the regulator, which can decline to deal with a complaint that has not gone to the controller first.
What you must do
- Facilitate complaints, for example by providing a complaint form that can be completed electronically. DPA 2018 s.164A
- Acknowledge receipt within 30 days of receiving the complaint. DPA 2018 s.164A
- Take appropriate steps to respond without undue delay, including making enquiries, and keep the complainant informed. DPA 2018 s.164A
- Tell the complainant the outcome without undue delay. DPA 2018 s.164A
Who is responsible
Every controller.
What it involves
- Publish how to complain, with an online form.
- Log and acknowledge within 30 days.
- Investigate, and handle any embedded rights request on its own clock.
- Respond with the outcome and next steps, including the right to go to the regulator.
Timing
Acknowledge within 30 days; respond without undue delay.
If it goes wrong
- Regulatory
- The regulator can take enforcement action for a failure to handle complaints, and an unanswered complaint is likely to become a complaint to the regulator.
- Criminal
- No offence.
- Civil
- The underlying infringement can still found a compensation claim under Art 82.
Go further
More on breaches and complaints
Sources
- Primary Data Protection Act 2018, section 164A legislation.gov.uk
- Primary Data (Use and Access) Act 2025, section 103 legislation.gov.uk
Updated