From 19 June 2026, organisations must comply with new requirements under the Data (Use and Access) Act 2025 for handling data protection complaints.
The legislation introduces a clearer statutory framework for dealing with complaints from individuals who believe an organisation has failed to meet its obligations under UK data protection law.
Organisations will need to:
- Provide an appropriate way for people to submit data protection complaints
- Acknowledge receipt within 30 days
- Investigate and respond without undue delay
- Keep the complainant informed about progress
- Explain the outcome of the complaint
Having an email address or contact form is not enough.
Organisations must have a documented and workable process that defines what happens after a complaint is received
This should clarify who is responsible, how complaints are identified and recorded, when they must be escalated, how investigations are carried out, and how responses are approved and communicated.
Employees also need clear guidance so that a complaint received through an unexpected channel does not get overlooked.
Well-written procedures help organisations demonstrate compliance, respond consistently and reduce the risk of missed deadlines, confusion or avoidable escalation to the Information Commissioner’s Office.
How Cherryleaf can help
Cherryleaf helps organisations create, review and improve policies, procedures, standards, manuals and employee guidance.
We can work with your subject-matter experts to turn your legal and operational requirements into clear, practical documentation that employees can understand and follow. This can include complaints-handling procedures, process maps, staff guidance, roles and responsibilities, templates and supporting checklists.
It might be the time to make sure your data protection complaints process is compliant, documented and ready to use.
See: Cherryleaf’s policy and procedure writing services.
Leave a Reply