The ICO has issued new guidance on how to deal with data protection complaints, where data subjects feel that you have infringed the data protection legislation because of the way you’ve handled their personal information, or the personal information of someone they’re acting on behalf of.
These requirements come into force on 19th June 2026 but it would be sensible to consider them now, and make sure that you can demonstrate compliance.
According to the ICO website https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/ data protection law says you must:
- give people a way of making data protection complaints to you;
- acknowledge receipt of complaints within 30 days of receiving them;
- without undue delay, take appropriate steps to respond to complaints, including making appropriate enquiries, and keep people informed; and
- without undue delay, tell people the outcome of their complaints.
You might choose to have a separate data protection complaints policy and mechanism for data subjects to make a complaint, or it could be a part of your overall complaints policy. The guidance above gives clear advice on what you need to include.