Further to our previous article, the new ‘right to complain’ brought in by the Data (Use and Access) Act 2025 is coming into force on 19 June 2026.
From 19 June 2026, individuals will have a right to complain directly to their employer if they consider there has been a breach of UK data privacy laws in respect of their personal data, and employers must facilitate these complaints by the provision of a complaints form, which can be completed electronically or otherwise.
Furthermore, for complaints made on or after 19 June 2026, the employer will have 30 days to acknowledge receipt and must “without undue delay” take appropriate steps to respond (such as making enquiries and informing the complainant of progress). The employer will also be required to inform the complainant of the outcome of the complaint.
Under regulation making powers, employers may in the future be required to inform the Information Commissioner’s Office ((the ‘ICO‘) soon to become the Information Commission) about the number of complaints they receive, but the details of this reporting process (including how and when to make a notification and how to calculate the number of complaints) are yet to be confirmed. In the meantime, the ICO guidance recommends employers track complaints made to help identify trends and areas to improve.
Practical Next Steps
Employers may wish to take the following steps in light of these changes:
- Update privacy notices to confirm that individuals have the right to complain from 19 June 2026. The ICO’s guidance states that employers must tell people they can complain both at the point the organisation collects their personal information and when responding to a subject access request
- Develop policies and procedures for handling data protection complaints
- Ensure record keeping systems are up to date
- Train staff on how to recognise and handle complaints
The ICO has also published guidance on how to deal with complaints, which may be helpful for employers trying to navigate these changes.
Many employers are already used to receiving and responding to complaints about the processing of employees’ personal data, although this new requirement is likely to formalise the process going forwards. Employers might see a small increase in complaints, but otherwise we do not anticipate that this will have a significant ongoing practical impact.
