The Data (Use and Access) Act strengthens expectations around how organisations manage data protection complaints. While complaint handling is not new, there is now a clearer requirement for structured, transparent, and accountable processes on how an organisation must handle a data protection related complaint.
Background
Regulatory focus has increasingly shifted towards how organisations engage with individuals, particularly when concerns are raised. Poor complaint handling often leads to escalation, including referrals to the ICO. The Act reflects this by formalising expectations and reinforcing the importance of resolving issues early and fairly.
New requirements
- A clear and accessible way for individuals to raise data protection complaints
- A requirement for the organisation to acknowledge complaints within 30 days
- An obligation to respond without undue delay, including making appropriate enquiries
- A requirement to communicate outcomes clearly and promptly
- A documented internal data protection complaints procedure
- Maintaining records of complaints and actions taken
Organisations are expected to place greater emphasis on:
- Timely resolution, ensuring complaints are addressed promptly
- Transparency, with clear, accessible communication throughout the complaint process
- Active engagement, demonstrating that complaints are taken seriously and addressed substantively
Â
Key Obligations for Organisations
Governance and oversight
Assign clear responsibility for complaint handling, typically to the DPO with escalation routes where issues indicate wider compliance risks.
Documentation
Maintain a written complaints procedure setting out how complaints are received and assessed. Ensure this is accessible to both staff and individuals.
Impact assessments
Where complaints highlight potential high-risk processing or systemic issues, organisations should consider whether a Data Protection Impact Assessment (DPIA) is required or needs updating.
Data handling and retention
Ensure complaint-related data is handled securely and only retained for as long as necessary.
What organisations should do now/next steps
Review or implement a complaints policy, ensure accessibility, train staff, and regularly review changes made to complaints to strengthen compliance.
How Hope and May can help
Hope and May can support with drafting complaint handling policies and internal procedures and embedding practical complaint handling processes aligned with regulatory expectations.
