Data protection complaints: what the new rule means for you

What changed

The Data (Use and Access) Act 2025 added a new right: people can complain directly to an organisation if they think it has broken data protection law in handling their personal data. The ICO confirmed the requirement came into force on 19 June 2026 and has published guidance. There are no exemptions for small organisations.

The law says you must:

• make it easy to complain, for example with a complaint form that can be completed electronically and by other means
• acknowledge each complaint within 30 days of receiving it
• without undue delay, take appropriate steps to respond, including making enquiries, and keep the person updated
• without undue delay, tell them the outcome

What counts as a complaint

Any complaint about how you've handled someone's personal data. It could be a booking confirmation sent to the wrong person, marketing emails after someone unsubscribed, or a slow reply to a request for their data.

The ICO is clear that you can invite people to use your process, but they don't have to. People can complain any way they choose: an email to the booking inbox, a note to a trustee, a comment at the counter. That's why everyone who deals with the public needs to recognise a complaint when they see one.

A simple setup for a small organisation

1. Choose your route: a short online form, plus an email address and a postal address for anyone who can't use it. The ICO says you don't need a separate tool, as long as you can meet the requirements.
2. Add a paragraph to your privacy notice. For example: "If you're unhappy with how we've handled your personal information, email data@[your domain] or write to us at [address]. We'll acknowledge your complaint within 30 days and tell you the outcome."
3. Name one person to check the inbox, plus a back-up for holidays.
4. Keep a simple log: date received, date acknowledged, what you did, outcome, date closed.
5. Save a short acknowledgement template, so replying takes two minutes.
6. Tell staff and volunteers what a data protection complaint looks like and where to pass it.

Worked example (made up)

A hirer emails on 3 March. Their booking confirmation, with their phone number, went to another hirer by mistake. The 30-day period starts on the day it arrives, so the latest you can acknowledge it is 1 April. In practice, reply within a day or two. The named person finds the cause (an autofill error), fixes it, then writes to the hirer explaining what happened and what changed. They log the whole thing.

At the end, the ICO says it's good practice to tell people they can complain to the ICO, with its contact details. The ICO will usually ask people to raise their complaint with you first, so a good process here saves everyone time.

Common mistakes

• A privacy notice that doesn't mention complaints at all.
• Complaints arriving at a personal inbox nobody else can see.
• Treating a complaint as closed without telling the person the outcome.

If you use a booking system or portal, check that its contact forms and emails go to an inbox your organisation controls. Our guide to taking village hall bookings online covers the other setup steps.

Sources

• legislation.gov.uk: Data (Use and Access) Act 2025, section 103
• ICO: How to deal with data protection complaints
• ICO: One month to go, what businesses need to know
• ICO: How do we prepare to handle data protection complaints?

Related

• Apps for charities
• Booking systems for councils
• Taking village hall bookings online, step by step

← Old phone network switch-off on 31 January 2027: what to check