Businesses given deadline for GDPR complaint process refresh

Malcolm Dowden of Pinsent Masons made the recommendation after the UK government made regulations in which it confirmed that the new complaint-handling regime provided for under the Data (Use and Access) Act (DUAA) would apply from Friday 19 June 2026. He said it will require many organisations to change how they handle data protection complaints currently.

“The new rules put the onus on controllers to be able to handle data protection complaints from data subjects irrespective of the mechanism those individuals choose to raise their complaint – whether that is via email, over the phone, via customer service chatbots or, potentially, via the controllers’ social media accounts, for example,” Dowden said.

“It means that even if organisations operate a complaints procedure that points complainants to, for instance, use a dedicated complaints form or to submit complaints to a specific address, they will still need to be able to identify – and be responsive to – complaints raised in other ways. This constitutes a significant change for how many organisations handle data protection complaints now and could necessitate an updating of systems, privacy policies, processes and staff training,” he said.

“The provisions are broad in that they will apply to any form of infringement under the UK General Data Protection Regulation (GDPR), not just to things like personal data breaches, and the changes reflect a general direction of travel taken by the UK’s data protection authority, the Information Commissioner’s Office, in recent years towards directing data subjects to direct complaints to controllers rather than to it – at least in the first instance. The ICO consulted on new complaints-handling guidance last autumn. Its final guidance, to help businesses understand what they can do in practice to meet the new requirements, is now likely to be issued ahead of the 19 June compliance deadline,” according to Dowden.

The complaints-handling reforms are just part of a wider package of changes to UK data laws that DUAA provides for. Many other aspects of that package – including rules relevant to using AI to make decisions; undertaking scientific research; circumstances where the purpose of data processing might change over time; and the enforcement of breaches of rules on ‘cookies’ and in relation to direct marketing – will enter into force this Thursday, 5 February 2026.