The Information Commissioner’s Office (ICO) has published updated guidance for organisations on how to deal with data protection complaints.

The guidance reflects upcoming changes to the rules on handling complaints introduced by the Data (Use and Access Act) 2025 (DUAA). Although the new provisions are not due to come into force until 19 June 2026, the guidance has been published now to allow organisations time to prepare.

We have commented previously (for example here) on the various new measures introduced by the DUAA. In the context of data protection complaints, new obligations on organisations include:

1. Facilitating the making of complaints by data subjects;
2. Acknowledging receipt of a complaint within 30 days;
3. Taking appropriate steps to respond to the complaint ‘without undue delay’; and
4. Keeping the complainant informed about the complaint’s progress and outcome.

The guidance provides detailed practical advice on how to comply with these requirements. For example, it sets out the different measures that an organisation might put in place to allow complaints to be made and addresses specific scenarios such as complaints made through social media or by children. More generally, it suggests that organisations consider adopting a complaints procedure, published on their website, which explains how people can make complaints and what they can expect from the process.

In terms of investigating complaints, the guidance provides advice on the form an acknowledgement should take, as well as the steps that should be followed to ensure that a complaint is investigated without undue delay, is properly recorded, and that the complainant is informed of its progress. It also recommends that, in addition to informing the complainant of the outcome of the investigation, organisations should conduct an internal review to consider if any lessons can be learned to prevent future complaints.

To read the guidance in full, click here.