The Data Use & Access Act (DUAA) has brought in a right for people to people to complain to the controller; controllers can stop the clock to clarify the request where this is reasonably required; and there is a requirement to make reasonable and proportionate searches.

If someone considers that you've infringed data protection legislation because of the way you've handled their personal information (or the personal information of someone they're acting on behalf of), they can complain to you. These measures come into force on 19th June 2026.

Get ready!

How to prepare to handle data protection complaints: https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/how-do-we-prepare-to-handle-data-protection-complaints/

What to do when you receive a complaint: https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/what-do-we-do-when-we-receive-a-complaint/

What to do after you have finished your investigation: https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/what-do-we-do-after-we-ve-finished-our-investigation/

How the ICO deals with complaints: https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/how-does-the-ico-deal-with-complaints/

Data Protecetion Help

Let us know if you need help. Fill in the form below.