The UK’s data protection rules are changing, with the new Data (Use and Access) Act 2025 introducing a number of new updates. The data protection law changes are put in place to promote innovation and support organisations, whilst still protecting people and their rights.
These changes have been phased in, between June 2025 and June 2026, are you aware of the impact they may have on you and your business?
What are the new requirements?
From 19 June 2026, organisations that process personal data under the UK GDPR need to have updated their privacy notices and have a clear process in place for handling data protection complaints.
Let’s take a look at what has changed around data protection complaints.
The new rules give individuals the right to complain directly to an organisation if they believe their personal data has not been handled in line with the UK GDPR.
To comply, organisations will need to:
- Make it easy for people to submit a data protection complaint (for example, through an online form or another accessible method).
- Acknowledge complaints within 30 days.
- Investigate complaints promptly and take appropriate steps to understand the issues raised.
- Keep the individual updated on the progress and outcome of their complaint.
- Explain in their privacy notice how individuals can make a data protection complaint.
- Keep records of complaints and how they were resolved.
So, what should organisations do now?
If your organisation is subject to the UK GDPR, now is the time to review your data protection processes. Here are the key practical steps to consider:
1. Update your privacy notice
Your privacy notice should explain:
- how individuals can make a data protection complaint
- the different ways they can submit a complaint
- how they can raise their concerns with the Information Commissioner’s Office (ICO) if they are not satisfied (and provide the ICO’s details)
You should also review any templates you may use for responding to data subject rights requests to ensure they signpost your complaints process where appropriate.
2. Put a clear complaints process in place
Have a documented process that explains how data protection complaints are received, investigated and resolved.
This should include:
- how complaints can be submitted
- how complaints are identified and assessed
- when issues should be escalated
- how investigations and responses will be managed
- how complaints and outcomes will be recorded
Remember, a complaint doesn’t have to mention “GDPR” or “data protection” to count. It can be made by email, phone, post, social media or even in person, so staff need to know how to recognise one.
3. Make sure you can track complaints
Your organisation should be able to record and monitor complaints from start to finish.
This includes keeping track of:
- when a complaint was received
- important deadlines, including the requirement to acknowledge complaints within 30 days
- the investigation and outcome
- recurring issues or trends that may need further attention.
4. Ensure your staff are aware of these changes and what to do
Anyone who might receive a complaint, this can include customer services teams. HR, managers, directors and legal and compliance teams. They should understand and be clear on the following:
- what a data protection complaint looks like
- how to escalate it internally
- the timescales for responding
- how complaints fit alongside other GDPR obligations, such as handling data breaches and subject access requests.
5. Review your contracts and third-party arrangements
If you rely on third-party providers to process personal data, check that your contracts clearly set out how they will support you with data protection complaints and other individual rights requests.
For organisations operating internationally, it’s also worth checking whether your global privacy processes need updating to reflect these new UK-specific requirements.
Taking these steps now will help your organisation meet the new legal requirements and demonstrate good data protection governance.
At Hartley Law, we are experts in all areas of commercial law, including data protection. If you would like to discuss where you may be in need of legal support or guidance, get in touch by calling us on 01276 536 410, or emailing us at hello@hartleylaw.co.uk, we would be delighted to discuss and understand how we can best assist you.
