New DUAA complaints provisions now in force



Mandated by the Data (Use and Access) Act 2025, UK organisations need to have a proper complaints process in place as from today. This means that an individual must first contact the organisation in question and use their internal complaints procedure before escalating a data protection complaint to the ICO.

Organisations are required to provide clearly publicised mechanisms to submit data protection complaints. This can be done by

  • Providing a complaint form that people can submit to you either electronically or in writing (e.g. by email or post);
  • Providing an email address for people to submit complaints to;
  • Allowing people to make complaints over the phone;
  • Providing an online complaints portal;
  • Having a live chat function with the option to escalate to a human if needed; or
  • Giving people a way to make complaints to you in person (e.g. if there is no online presence).

Organisations need to acknowledge complaints within 30 days of receipt and respond without undue delay. The obligation to investigate begins when an organisation receives the complaint, not after the 30-day acknowledgement period.

See:

PL&B 39th International Conference in Cambridge 6-8 July will include a session ‘Navigating complaints and DSARs in the UK’s Data (Use and Access) Act: Where do you draw the line