Companies across the UK have less than a month to put a data protection complaints process in place before new legal requirements come into force on Friday, June 19, 2026. 

From that date, all organisations will be legally required to handle data protection complaints under the Data (Use and Access) Act 2025. 

The Information Commissioner’s Office (ICO) has urged businesses, particularly small and medium-sized enterprises, to review its guidance and follow the simple steps required for compliance.

This new law requires organisations to provide a clear process for individuals to raise data protection complaints, acknowledge receipt within 30 days without unnecessary delay, take suitable steps to investigate, keep complainants informed, and communicate the results.

Emily Keaney, deputy commissioner at the ICO, explained that smaller organisations often lack formal complaints processes, which is why the guidance offers practical steps and real examples encountered daily.

She said: “A data protection complaint can come from any customer at any time. Having a clear process means you can respond quickly, resolve issues fairly and protect the trust your customers place in you. 

“We are not here to catch businesses out; we are here to help you get ready.”

The ICO’s guidelines, published in February, walk business owners through everything they need to know about the upcoming change in the law, from what their businesses must, should, and could do to comply, to practical tips for each stage of the process. 

ICO’s message is that having a clear complaints process is not just a legal requirement but also good for business and customers, as it can prevent issues from escalating, protect customer trust, and reduce the likelihood of regulatory involvement. 

Businesses are encouraged to read the guidance and act as soon as possible. 

The guidelines are available at https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/, or businesses can visit the ICO’s website for more tailored advice.