19 June 2026: Is Your Data Protection Complaints Procedure Ready?

29/05/2026

From 19 June 2026, organisations handling personal data must have an internal complaints process in place under changes introduced by the Data (Use and Access) Act 2025.

It will no longer be enough to simply direct individuals to the ICO. Organisations must be able to:

• receive and investigate data protection complaints;
• respond within statutory timescales; and
• explain escalation rights.

If an individual cannot easily find:

• how to complain,
• who to contact,
• expected response times, and
• their right to escalate to the ICO,

then the organisation is likely to struggle to demonstrate compliance with the new requirements under the Data (Use and Access) Act 2025.

For most organisations, the safest approach is:

• update the privacy notice; and
• publish a short standalone data protection complaints procedure online.

For many organisations, this also means reviewing polices and procedures, website content and staff practices.

This is one of the quieter changes within the DUAA 2025, but potentially one of the most overlooked.

With the deadline approaching quickly, now is the time to check whether your organisation’s data protection complaints process is actually in place and whether staff know how to use it.

If you need some bespoke guidance, new policy or complaints procedure email dpo@jhdataprotection.com