Since 19 June 2026, every UK organisation that processes personal data must give people a clear way to complain about how that data is used, acknowledge each complaint within 30 days, investigate it and tell the complainant the outcome. With the complaints provisions in force, the ICO now states that all of the data protection provisions of the Data (Use and Access) Act 2025 have commenced. For regulated firms, the complaints that will test this process hardest are the ones that follow a security failure.
The Data (Use and Access) Act 2025 is the most significant reform of UK data protection law since 2018. It received Royal Assent on 19 June 2025 and has been commenced in stages: according to the government’s commencement plan, most of the main data protection changes took effect on 5 February 2026, and the complaints duty followed a year after Royal Assent.
What exactly do organisations have to do now?
The ICO summarised the duty on 23 June 2026: “All organisations must now give people a clear way to raise a data protection complaint, acknowledge it within 30 days, investigate appropriately and communicate the outcome.” In practice that means four things.
- A clear route. The Act expects organisations to make complaining easy, and the ICO gives an electronic complaints form as an example of the kind of step it means.
- Acknowledgement within 30 days. The ICO’s guidance is that the 30 days start the day after the complaint is received, regardless of weekends or bank holidays, with the deadline moving to the next working day if it falls on one.
- Investigation without undue delay. The organisation must look into the complaint properly and keep the complainant informed.
- An outcome. The complainant must be told what was found and what, if anything, has changed.
The ICO also found that awareness is low. Its research showed that more than two in three businesses aware of the Act either did not know whether the law change applied to them or wrongly thought it did not. Emily Keaney, the ICO’s Deputy Commissioner for Regulatory Policy, described the change as “about good data protection becoming business as usual”. The ICO has said its focus is on helping organisations embed good practice rather than catching them out.
Why is a complaints duty a security issue?
Because the most serious data protection complaints arrive after a breach. People rarely complain about a lawful basis they have never thought about; they complain when they receive a breach notification letter, when their details appear somewhere they should not, or when a fraudster contacts them using information only your firm held.
At that point the complaints process stops being an administrative workflow and becomes part of the incident. Every acknowledgement and outcome letter is a written account of what happened and what the organisation has done about it. If the firm cannot say how the attacker got in, what data was taken or which controls have since changed, the complaint responses will be vague, and vague responses produce escalations to the regulator.
What does the ICO expect the underlying security to look like?
The clearest recent signal is the ICO’s fine against South Staffordshire Plc and South Staffordshire Water Plc, announced on 11 May 2026. Personal data belonging to 633,887 people was extracted and published on the dark web after an attack that began in September 2020 and largely took place between May and July 2022. The ICO identified four failings:
- limited controls that allowed the attacker to escalate to administrator privileges;
- inadequate monitoring and logging, with only 5% of the IT environment monitored;
- obsolete, unsupported software on some devices, including Windows Server 2003;
- inadequate vulnerability management, including unpatched critical systems.
The penalty was £963,900, after a 40% reduction for early admission of liability and cooperation. Ian Hulme, the ICO’s Interim Executive Director for Regulatory Supervision, said: “The steps that South Staffordshire failed to take are established, widely understood and effective controls to protect computer networks.”
None of those four failings is exotic. Privileged access, monitoring, supported software and patching are the same controls a cybersecurity audit examines first, and the same controls a complainant’s solicitor will ask about.
Where does AI fit into the new complaints regime?
Automated decisions are one of the most likely sources of new complaints. The Act reformed the rules on automated decision-making, replacing the old Article 22 with new Articles 22A to 22D, which permit more automated decisions but require safeguards: telling people about significant decisions made about them, letting them make representations, and offering human intervention and a way to contest the decision.
The complaints duty gives people a direct, statutory route to raise concerns about those decisions with the organisation first. A firm using AI to triage applications, score risk or prioritise cases should expect complaints to ask, in effect, “was a person involved, and on what basis?” Answering that requires knowing where AI sits in the firm’s processes, which is the point of an AI usage audit and the ongoing purpose of AI governance.
What to do this quarter
- Publish a clear complaints route on your privacy notice and website, ideally including an electronic form.
- Set a 30-day acknowledgement deadline in whatever system logs complaints, counting from the day after receipt.
- Connect the complaints process to your incident response plan, so that complaints after a breach are handled by people who know the facts.
- Prepare template acknowledgement and outcome letters, reviewed by whoever owns data protection.
- Check the four South Staffordshire failings against your own estate: privileged access, monitoring coverage, unsupported software and patching.
- Identify any automated decisions with significant effects on individuals and confirm the Article 22A to 22D safeguards are in place.
How Rhentech helps
We help regulated firms make sure that when a complaint arrives, the security story behind it holds up. A cybersecurity audit tests the controls the ICO cited in May. Our incident response service builds the plan that links breach handling to complaint handling. Where AI is involved, our AI usage audit maps where automated decisions are being made. Our January article on UK GDPR and cybersecurity obligations sets out the wider regulatory context for boards.
If you are not sure your complaints process and your security controls would stand up to the same scrutiny, book a free initial consultation to talk it through.
Frequently asked questions
What is the new data protection complaints requirement?
From 19 June 2026, organisations must give people a way to complain about how their personal data is used, such as an electronic complaints form, acknowledge each complaint within 30 days, investigate it without undue delay and tell the complainant the outcome. The requirement comes from the Data (Use and Access) Act 2025.
Does the complaints duty apply to small firms?
Yes. The ICO’s announcement of 23 June 2026 says all organisations must now provide a clear route for data protection complaints. Its own research found that more than two in three businesses aware of the Act either did not know whether the law change applied to them or wrongly thought it did not.
How does the complaints duty relate to cybersecurity?
Many data protection complaints follow a security incident, because that is when people learn their data has been exposed. A firm that cannot explain what happened, what data was affected and what it has changed will struggle to answer complaints well, and the record it creates may later be read by the regulator.
Is all of the Data (Use and Access) Act now in force?
The ICO states that all of the data protection provisions of the Act were in force by 19 June 2026. Most of the main data protection changes commenced on 5 February 2026, and the complaints provisions followed on 19 June 2026, roughly a year after Royal Assent.
Sources
- ICO, New data protection complaints law now in force, 23 June 2026.
- ICO, How to deal with data protection complaints, guidance, June 2026.
- ICO, The Data (Use and Access) Act 2025: what does it mean for organisations?, updated 19 June 2026.
- DSIT, Data (Use and Access) Act 2025: plans for commencement, GOV.UK.
- ICO, Fine of nearly £1m issued against South Staffordshire Plc and South Staffordshire Water Plc, 11 May 2026.
Reviewed 20 October 2026.