The Information Commissioner’s Office has warned UK businesses they have just one month from today to put a data protection complaints process in place, before new legal requirements come into force on June 19 2026.
The new law, which falls under the Data (Use & Access) Act 2025, means all organisations must give people a clear way to raise a data protection complaint; acknowledge it within 30 days of receipt; take appropriate steps to investigate and keep people informed; and tell the complainant of the outcome.
The ICO has stated there are no exemptions for small businesses or charities and while companies do not strictly have to publish a standalone public “policy” document, they must have an active, accessible process in place to handle complaints directly.
The regulator says its guidance, published in February following a public consultation, is already available and sets out everything organisations need to know. It explains what businesses must, should and could do to comply, and includes practical tips for each stage of the process.
ICO deputy commissioner of regulatory policy Emily Keaney said: “Today marks one month to go, and I want to be clear: there is still plenty of time to act, and the ICO is here to support you.
“We know that smaller organisations are less likely to have formal complaints processes in place, and that is exactly why we have designed this guidance with you in mind: with practical steps and real examples that you’ll have encountered on a day-to-day basis.
“A data protection complaint can come from any customer at any time. Having a clear process means you can respond quickly, resolve issues fairly and protect the trust your customers place in you.
“We are not here to catch businesses out, we are here to help you get ready. With June 19 fast approaching, now is the time to read the guidance and make sure you’re prepared.”
Related stories
ICO plans triage system to tackle complaints emergency
Lawmakers urged to act on ‘severe’ failings of the ICO
Complaints to the ICO soar as performance takes a hit
The £161bn question: Will EU renew data transfer deal?
DMA claims Data Act victory as privacy groups seethe
ICO unveils business guidance as Data Act becomes law
Four years in the making, UK data reforms are passed
Be the first to comment on "ICO warns firms to get in shape for new data complaints"