Learning 4 - Security, breaches and complaints
Completion requirements
1. Section 4: Security, breaches and complaints
1.3. 4.3 Data protection complaints
4.3 Data protection complaints
The current legal process for complaints about personal-data handling.
Requirements in force from 19 June 2026
Organisations must:
- give people a way to make a data protection complaint;
- acknowledge receipt within 30 days;
- take appropriate steps to respond without undue delay, including making appropriate enquiries;
- keep the complainant informed about progress; and
- tell the person the outcome without undue delay.
Thirty days is the acknowledgement deadline. It is not automatically the deadline for resolving every complaint, but the organisation must act without undue delay and keep the person informed.
A good complaint process
- Provide a visible and accessible route, such as an electronic form or clear email address.
- Record the complaint, date and issues.
- Acknowledge within 30 days and explain next steps.
- Investigate objectively and gather relevant evidence.
- Address connected rights requests or breach issues.
- Communicate progress where the investigation continues.
- Give a clear outcome, reasons, remedial action and escalation information.
- Use complaint trends to improve systems and training.
Knowledge checkpoint
Answer each question before opening the suggested answer.
1. When did the statutory complaints requirements come into force?
Suggested answer: 19 June 2026.
2. What is the acknowledgement period?
Suggested answer: Within 30 days of receiving the complaint, calculated under the applicable rules.
3. Must a complaint be fully resolved within 30 days?
Suggested answer: Not necessarily. The organisation must acknowledge it within 30 days, act without undue delay, keep the person informed and provide the outcome without undue delay.
Official reference points
- ICO: How to deal with data protection complaints
- ICO: New data protection complaints law now in force
- legislation.gov.uk: Data (Use and Access) Act 2025
Legal accuracy: reviewed against official UK sources on 14 July 2026. This learning content is educational and is not a substitute for case-specific legal advice.