Written by Data protection – ICO complaints – practical guidance
Since 19 June 2026 every organisation handling personal data has been under a statutory duty to run a data protection complaints process: acknowledge within 30 days, investigate, and report the outcome back without undue delay. This guide explains the new duty, how to escalate to the ICO, and how the complaints track sits alongside a court claim for compensation.
Snapshot
The Data (Use and Access) Act 2025 turned complaint-handling from good practice into a legal duty. A data subject who considers that an organisation has infringed the UK GDPR or Part 3 of the Data Protection Act 2018 now has a statutory right to complain directly to that organisation, and the organisation must acknowledge the complaint within 30 days. The ICO route remains, reformed and consolidated, with a tribunal backstop if the regulator itself stalls. Compensation is not part of either route: it runs through negotiation or the courts.
What changed on 19 June 2026
The Data (Use and Access) Act 2025 is a wide-ranging reform of UK data protection law. One part matters to anyone with a grievance about how their personal information is handled: section 103 of, and Schedule 10 to, the Act came into force on 19 June 2026, and with them a structural change in how data protection complaints begin.
The centrepiece is a new section 164A of the Data Protection Act 2018. It gives a data subject a statutory right to complain to the controller – the organisation that decides how and why personal data is processed – where the data subject considers there has been an infringement of the UK GDPR or of Part 3 of the 2018 Act. This is not a voluntary scheme. The controller must facilitate complaints, for example by providing a complaint form that can be completed electronically as well as by other means.
At the same time, the regulator side of the route was redrawn. The right to complain to the Commissioner is now consolidated in section 165 of the 2018 Act and expressly covers infringements of the UK GDPR; the parallel free-standing right in Article 77 of the UK GDPR has been removed. The practical effect is a two-tier structure: the organisation as the first port of call, the regulator behind it. The ICO’s guidance to organisations is blunt: every organisation must have a process for handling data protection complaints, and there are no exemptions.
The new first stop: the organisation
Two duties now bind the organisation receiving a data protection complaint. The first concerns acknowledgement. The controller must acknowledge receipt of the complaint within 30 days of receiving it. The ICO counts the 30 days from the day after the complaint is received, and where the period ends on a weekend or public holiday the organisation has until the next working day. Acknowledgement is not resolution: it is confirmation that the complaint has been received and is being investigated.
The second duty is about substance. The controller must, without undue delay, take appropriate steps to respond to the complaint and inform the complainant of the outcome – and taking appropriate steps includes making enquiries into the subject matter to the extent appropriate and keeping the complainant informed about progress. There is no fixed statutory deadline for the outcome itself, because how long a proper investigation takes depends on the complaint; the ICO’s formulation is an outcome without an unjustifiable or excessive delay. An organisation that goes silent can be chased for an update, and its duty to keep you informed is statutory, not a courtesy.
How the complaint is framed makes a difference. The ICO advises complainants to say expressly that they are making a data protection complaint, give enough detail to locate the information, be specific about what went wrong and what would put it right, explain the effect, and keep copies of everything. A short, specific complaint – around 500 words – is harder to mishandle than a long one.
Key distinction. The 30-day clock runs to acknowledgement, not to a final answer. An organisation that acknowledges on day 29 and then investigates properly is compliant; one that acknowledges on day 2 and then goes quiet for months is not.
The duty has teeth. A failure to comply with section 164A is itself a failure for which the Commissioner can serve an enforcement notice, and it carries a monetary penalty of up to the standard maximum amount. An organisation that ignores a data protection complaint is not merely being unhelpful; it is exposing itself to regulatory action.
Escalating to the ICO: what you need to show
If the organisation’s response is inadequate – or never arrives – the route runs to the Information Commissioner’s Office. Under section 165 of the 2018 Act, a data subject may complain to the Commissioner about an infringement of the UK GDPR or of Part 3 or 4 of the Act. The Commissioner must take appropriate steps to respond, investigate the subject matter to the extent appropriate, inform the complainant of the outcome, keep the complainant informed about progress, tell the complainant about the tribunal rights discussed below, and provide further information about how to pursue the complaint if asked.
Escalation is evidence-led. The ICO’s complaint service asks for an email address for the organisation, a copy of the complaint you made to the organisation, a copy of any rights request you made (such as a subject access request), supporting information about the harm experienced, and – if you complain on someone else’s behalf – a letter of consent from that person. You can complain to the ICO at any time, but it recommends giving the organisation a chance to complete its own process first: that may resolve matters sooner and let the ICO deal with the complaint more quickly. The paper trail from the first stage is not bureaucracy; it is the price of admission to a fast, well-founded escalation.
What happens next has also changed. Following a public consultation, the ICO now handles complaints under a published complaints handling framework. Each complaint is triaged, with the harm experienced assessed on a scale from low to high-level impact, and the depth of investigation ranges from a light-touch review to more detailed enquiries. Complaints that need detailed examination are currently being assigned to case officers within 40 weeks of submission. The most common outcomes are that the complaint is logged for intelligence purposes, or that the ICO tells the organisation to do more work – for example, to provide the information or correct the inaccuracy.
The tribunal backstop if the ICO itself stalls
The reformed route does not leave the complainant dependent on the regulator’s goodwill. Where the Commissioner fails to take appropriate steps to respond to a complaint, or fails to provide information about progress or the outcome within three months of receiving it – or within any subsequent three-month period – the data subject may apply to the First-tier Tribunal. The tribunal can order the Commissioner to take appropriate steps, to inform the complainant of progress or outcome within a specified period, or to conclude an investigation or take a specified step within a set time. The Commissioner is required to tell complainants about these rights as part of the complaint response.
The organisation’s handling is regulated by the ICO; the ICO’s handling is supervised by a tribunal. Accountability runs at both tiers, enforceable rather than aspirational.
Compensation is a separate track
One boundary matters most for complainants whose real objective is redress. The ICO cannot award compensation – not even where it takes the view that an organisation has broken data protection law. A complaint to the regulator can produce findings, recommendations and compliance steps and, in serious cases, enforcement action. It cannot produce damages.
Compensation runs through negotiation or the courts. Under Article 82 of the UK GDPR, any person who has suffered material or non-material damage as a result of an infringement has the right to receive compensation from the controller or processor. The parallel provision in section 169 of the 2018 Act confirms that damage includes financial loss and damage not involving financial loss, such as distress. The ICO strongly recommends independent legal advice on the strength of the case before a court claim.
The two tracks interact without merging. The complaint route builds the chronology, the correspondence and, sometimes, a regulatory view on compliance. But a complaint to the ICO is not a claim, and an ICO outcome is not an award. Choosing between them – or sequencing them – is a decision about objectives: changing an organisation’s behaviour points one way, recovering compensation points the other.
A step-by-step complaints playbook
The reformed route rewards discipline: each stage produces the material the next stage needs.
Use its published process, state expressly that you are making a data protection complaint, be specific, and keep a copy of everything you send.
Expect acknowledgement within 30 days, ask for progress updates, and press for an outcome without undue delay.
Complain to the ICO with your complaint, the response and evidence of the harm. Expect triage under its framework.
If the ICO stalls, consider a tribunal application under section 166. If your objective is compensation, that is a negotiation or court claim – take advice on its strength first.
Source anchors
Section 103 and Schedule 10 create the new statutory complaints tier and its enforcement machinery.
Sections 164A, 165 and 166, as amended: the complaint to the controller, the complaint to the Commissioner, and the tribunal backstop.
Regulation 3 brought the complaints provisions into force on 19 June 2026.
The ICO’s public guidance hub, including its guide to making a data protection complaint to an organisation.
The ICO’s complaint service, its complaints handling framework, and what it can and cannot deliver.
The regulator’s announcement of the new duties taking effect on 19 June 2026.
These anchors support the framework described; they are starting points for your own reading, not a determination of any individual complaint.
The closing point
The Data (Use and Access) Act has turned complaint-handling from courtesy into obligation, with a clock on the first 30 days and a tribunal watching the regulator. None of it compensates anyone by itself. The merits matter. But procedure decides when the merits are heard – and in data protection, procedure now starts with a clear, dated, documented complaint to the organisation.
Complaint route decision point
Get a free written assessment of the complaint route
Legal Lens can structure a preliminary written review of a data protection complaint: which stage the matter has reached, what the paper trail still needs, and how the ICO route sits alongside any claim for compensation.
Organisation, ICO, tribunal and court – sequenced against what has already happened and what you want to achieve.
The complaint, the response, the chronology and the harm – organised so each stage builds on the last.
Assessment outputs
The complaint stages, sequenced, with the live options at each.
What the trail still needs before escalation or a claim.
Independent Legal Lens consultancy. Legal Lens is not a regulated solicitors’ firm. A preliminary assessment is not a substitute for regulated legal advice where that is needed.