Data protection complaints

How a controller handles a data protection complaint under the duty in DPA 2018 s.164A, for complaints received from 2026-06-19: make complaining easy, acknowledge within 30 days, investigate, keep the person informed and give the outcome without undue delay.

Applies to: Every controller, for complaints about infringement of the UK GDPR or Part 3 DPA 2018 relating to the complainant's own data.
Instruments: DPA 2018, UK GDPR
Steps: 7 steps, with a deadline calculator, including a step that carries a criminal offence.

Deadline calculator

Acknowledge a data protection complaint

Acknowledge within 30 days of receiving the complaint (complaints received from 2026-06-19).

Date the complaint was received

Enter a date to calculate.

Basis: DPA 2018 s.164A(3). Bank holidays for 2025 to 2028, by the standard calendar rules. A calculator, not advice.

Mechanics

Item	Position
In force	Complaints received from 2026-06-19 (SI 2026/82 regs 3 and 7)
Acknowledge	Within 30 days of receipt (s.164A(3))
Respond	Appropriate steps without undue delay, including enquiries and progress updates (s.164A(4) and (5))
Next stop	Information Commission (Art 77)

Steps

Make complaining easy

Provide an easy route, such as an electronic complaint form, alongside other means (s.164A(2)). Publish it in your privacy information.

See DPA 2018
Log and acknowledge within 30 days

Record the date received and acknowledge receipt within 30 days (s.164A(3)).

See DPA 2018
Identify what is being alleged

Separate each allegation and tie it to the provision it engages. A complaint often contains a fresh rights request: if it does, start that clock too.

See DPA 2018
Make enquiries

Take appropriate steps to investigate, to the extent appropriate, including asking the teams involved and reviewing records (s.164A(5)).

See DPA 2018

Criminal offence Do not alter or delete records connected with a pending subject access or portability request while investigating. Doing so to prevent disclosure is an offence under DPA 2018 s.173.
Keep the complainant informed

Tell them how the investigation is progressing (s.164A(5)).

See DPA 2018
Give the outcome without undue delay

Explain what you found, what you have done, and that they can complain to the Information Commission if dissatisfied (s.164A(4); Art 77).

See DPA 2018
Record and learn

Keep a record of complaints and outcomes. It is evidence of accountability and the regulator may ask for it.

See UK GDPR

Checklists and tools for this procedure