We're making improvements to our website and we'd love to hear your thoughts.
Please take five minutes to complete this survey to give your feedback.
Businesses across the UK have one month from today to put a data protection complaints process in place, before new legal requirements come into force on 19 June 2026.
From that date, all organisations will be legally required to handle data protection complaints under the Data (Use and Access) Act 2025.
With just four weeks remaining, we are urging businesses, particularly small and medium-sized enterprises, to read our guidance now and take the straightforward steps needed to comply.
The new law means organisations must:
The good news for businesses is that our guidance, published in February following a public consultation that received more than 85 responses, is already available and sets out everything organisations need to know. It explains what businesses must, should and could do to comply, and includes practical tips for each stage of the process.
Emily Keaney, Deputy Commissioner, Regulatory Policy at the Information Commissioner’s Office, said:
“Today marks one month to go, and I want to be clear: there is still plenty of time to act, and the ICO is here to support you.
“We know that smaller organisations are less likely to have formal complaints processes in place, and that is exactly why we have designed this guidance with you in mind: with practical steps and real examples that you’ll have encountered on a day-to-day basis.
“A data protection complaint can come from any customer at any time. Having a clear process means you can respond quickly, resolve issues fairly and protect the trust your customers place in you.
“We are not here to catch businesses out, we are here to help you get ready. With 19 June fast approaching, now is the time to read the guidance and make sure you’re prepared.”
We are here to support all organisations meet these new requirements. Resolving complaints quickly and fairly benefits businesses as well as customers. It can prevent issues from escalating, protect customer trust and reduce the likelihood of regulatory involvement.
Sectors where data protection complaints are most common include healthcare, financial services, technology and retail. Our message is that having a clear complaints process is not just a legal requirement, it is good for business.
Businesses are encouraged to read the guidance and take action today. Visit our website for more tailored advice for small and medium sized businesses.
All text content is available under the Open Government Licence v3.0, except where otherwise stated.