The recently enacted Data (Use and Access) Act 2025 introduces some important changes to existing UK data protection laws.

One of these changes is the introduction of a new right for individuals to complain to organisations about how their personal data is managed by them. 

On the face of it, the concept of data protection complaints is nothing new – individuals already have various rights under data protection laws to access their data, to have their data erased, to object to direct marketing, etc. and often such rights are exercised in the context of a complaint or dispute. However, at present when individuals seek to complain specifically about data protection matters, there is no specific process which organisations must follow, or even an obligation to respond.

That is all set to change with the introduction of the new “right to complain”. Controllers will be obligated to acknowledge complaints within 30 days, to investigate complaints without undue delay, and to issue a clear outcome to the individual. Controllers must also make reasonable means available to individuals to help them exercise this new right – such as making a complaint form available online.

The specific changes under the Data (Use and Access) Act relating to the right to complain are not due to come into force until June 2026. However, on a shorter timescale, the ICO is expected to overhaul their approach to handling data protection complaints, which in practice may result in more complaints being handled by organisations instead of the regulator.

The ICO has recently announced their new plans to introduce triaging for data protection complaints. This is in light of the fact that projected complaints to the ICO for 2025/26 are expected to reach record-levels of up to 55,000 (up from 42,881 last year). This means that only complaints meeting certain criteria are likely to be investigated, with most complaints expected to be recorded without investigation.

While some may welcome a more consistent approach to complaint-handling from the ICO, this could be a case of “be careful what you wish for”. The ICO’s draft consultation indicates that even if complaints are not investigated, they will still be recorded - and the ICO will systematically monitor the levels of complaints received against specific organisations and sectors. An unexplained spike in complaints, even if not investigated individually, could trigger a much broader ICO compliance review or audit.

With complaints generally expected to rise (particularly in light of the increased use of Gen AI tools to formulate complaints in seconds), the new right to complain and triaging approach by the ICO will inevitably lead to organisations having to take on this burden themselves. With data protection compliance playing an increasingly important role in brand, reputation, customer experience, talent acquisition and employee retention, having an established data governance model is fundamental to meeting this challenge.

For a discussion about how we can help you with your data governance needs, please contact David Goodbrand or Jo McLean.

We will be discussing this and more at our upcoming data and cyber conference taking place on 30th September in Edinburgh. Find out more and sign up here.

Related News, Insights & Events