The Data (Use and Access) Act 2025 added a new section, 164A, to the Data Protection Act 2018. It came into force on 19 June 2026. It applies to every controller, of any size, and the Information Commission's guidance says there are no exemptions.
What the law requires
A controller must:
- Make it easy to complain. The Act gives the example of a complaint form that can be completed electronically and by other means.
- Acknowledge the complaint within 30 days of receiving it.
- Deal with it without undue delay. That means taking appropriate steps, making the enquiries needed, keeping the person informed of progress and telling them the outcome.
The complaints this covers are about how you've handled someone's personal data. They're separate from subject access requests, which have their own rules and time limits, though one often leads to the other.
What a small company needs in place
For most startups, meeting the duty is a few hours' work:
- A route. A short web form linked from your privacy notice, plus an email address for people who won't use a form.
- An owner. One named person who receives complaints and tracks the 30 days. If you have a DPO, this sits naturally with them.
- A log. Date received, date acknowledged, what you checked, what you decided and when you told the person. Section 164B lets the Secretary of State require controllers to report complaint numbers in future, so a simple log now saves rework later.
- Template replies. An acknowledgement and an outcome letter, written in plain English.
- A link to escalation. People can still complain to the Information Commission, so your outcome letter should say so.
Where it overlaps with customer requirements
Enterprise customers often ask in their data processing agreement how you handle complaints and requests from individuals. A written procedure and a log answer that question with evidence rather than a promise.
Where it doesn't change anything
The duty doesn't change when you need a Data Protection Officer. Article 1 covers those tests.
Next step: Goldline's Outsourced DPO sets up the complaints route, log and templates in the first month. If you only need the route checked, book a free diagnostic.
Sources: Data (Use and Access) Act 2025 s.103 (legislation.gov.uk/ukpga/2025/18/section/103); S.I. 2026/82 reg. 3(a); Information Commission, How to deal with data protection complaints (ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints).