Handling Data Protection Complaints

Since 19 June 2026, organisations must have a process for handling data protection complaints.

A data protection complaint is when someone believed your organisation has not handled their personal information in line with data protection law. They do not need to use legal terms for their concern to count as a complaint.

Read the ICO guidance on what counts as a data protection complaint.

What does your organisation need to do?

You must:

• Give people a clear way to make a data protection complaint
• Acknowledge a complaint within 30 days
• Take appropriate steps to look into the complaint and keep the person informed
• Tell them the outcome without undue delay

You can use an existing complaints process, as long as it allows you to meet your data protection responsibilities.

Read the ICO guidance of preparing to handle data protection complaints.

Read the ICO guidance on what to do when you receive a complaint

When you have finished

Explain the outcome clearly and let the person know what they can do if they are still unhappy.

They can make a complaint to the Information Commissioner’s Office (ICO). The ICO recommends giving your organisation the opportunity to deal with the complaint first where possible.

Read the ICO guidance on what to do after an investigation.

Read how the ICO deals with data protection complaints

Check your organisation is ready

Use our simple checklist to check your current process and identify anything you may need to update.

Download the Data Protection Complaints Readiness Checklist

Further guidance

For full guidance on your responsibilities, visit the ICO’s guidance on handling data protection complaints

Next Topic: Lawful Basis