The Data (Use and Access) Act 2025 (DUAA) is a key part of the UK data protection framework alongside the retained EU law version of the General Data Protection Regulation ((EU) 2016/679) (UK GDPR) and the Data Protection Act 2018 (DPA).
The DUAA established a requirement for data controllers to facilitate a complaint handling process for data subjects unhappy with how their personal data has been processed by the data controller. The ICO has indicated that in most cases it will expect data subjects to raise complaints with data controllers before escalating any unresolved issues to the ICO, so failure to implement a robust complaints procedure may risk the ICO investigating this and other aspects of a data controller’s business and privacy compliance. It is important that businesses understand their obligations and have in place a compliant process to ensure that they meet these requirements.
What are the obligations on data controllers?
Section 103 of the DUAA inserts section 164A into the DPA. This new provision sets out the right of a data subject to make a complaint to a data controller if the data subject considers that the controller has infringed the UK GDPR in connection with the personal data of the data subject.
- A controller must facilitate the making of complaints under this section by taking steps such as providing a complaint form which can be completed electronically and by other means.
- A controller must acknowledge receipt of a complaint within 30 days of receipt.
- Without undue delay, a controller must take appropriate steps to respond to the complaint (such as making further enquiries about the complaint) and inform the data subject making the complaint about progress and the outcome.
Practical examples
There are many potential situations which might lead to a data subject making a complaint under the new regime. We have included a few examples to demonstrate the privacy issues which could lead to complaints, please note this is not intended to be an exhaustive list:
- Data Subject Access Requests (DSARs)
Under Article 15 of the UK GDPR, individuals have the right of access to their personal data. If a business ignores a DSAR, misses the statutory one-month deadline (or withholds or redacts information when not entitled to do so), a formal complaint can be lodged under the DUAA.
- Direct marketing and opt-outs
Under the UK GDPR, individuals have an absolute right to object to direct marketing at any time. Where a business continues to send marketing emails or texts following an individual opting out or withdrawing their consent, this constitutes a breach of the UK GDPR and a complaint can be lodged with the business by the data subject.
- Data breach
Under Articles 33 and 34 of the UK GDPR, businesses must notify the ICO of a personal data breach within 72 hours of becoming aware of it (where feasible) unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. Businesses must also notify affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms. If a business fails to notify within these time limits it may lead to a complaint from a data subject impacted by the breach. Note that it is also possible for a data subject to make a complaint about a data breach even where the breach is not reportable by the organisation to the ICO.
What should businesses do to meet these requirements?
In order to meet these new requirements, a business needs to set up a complaints mechanism that complies with the provisions of the DPA and also ensure it has sufficient training and guidance in place for staff to recognise and deal with complaints as required.
- It is important to have a complaints form available in electronic and other formats.
- Staff should be trained to recognise if a complaint is being made by other means as a data subject is not required to use a complaints form even if provided.
- Have suitable governance in place so that the required acknowledgement, progress reporting and confirmation of final outcome following a complaint are made to the data subject within required timeframes.
- Keep a record of all complaints received, any investigatory steps taken and the outcomes.
- Review and update privacy notices, policies and other documents as required to reflect the complaints process and provide contact information etc.
- Consider if the business needs a dedicated privacy function (such as data privacy officer or data privacy manager) or department to handle complaints and other privacy compliance issues.
How 3CS can help
The new complaints handling requirement introduces another privacy risk for data controllers to address. Whether updating existing governance or starting afresh, we can help you develop a complaint handling process that is practical, compliant and appropriate for your business.
We also advise clients on a range of privacy law issues including compliance audits, staff training, governance reviews and drafting support for privacy notices, data processing agreements, records of processing activities and other key data protection documentation.
For advice and guidance, please get in touch.
