New data protection complaints rules from June 2026: are you ready?

This change places a clear obligation on organisations to ensure they are fully prepared to receive, investigate and respond to complaints in a timely and transparent manner.

At the core of this requirement is the need for a clearly documented and accessible complaints process. Individuals must be able to understand how to raise concerns about the use of their personal data, and organisations must ensure this process is easy to find and use. Internally, staff should be trained to recognise and escalate complaints appropriately.

A key element of compliance is acknowledgement. Organisations must confirm receipt of a complaint within 30 days, demonstrating that concerns are being taken seriously. Failure to respond promptly may erode trust and expose the organisation to regulatory scrutiny.

Equally important is the quality of the response. Investigations should be thorough, proportionate and well documented, with outcomes clearly communicated to the individual. Responses should address the issues raised, explain any findings, and set out any actions taken or proposed.

Overall, these requirements emphasise accountability and transparency. By implementing robust complaint-handling procedures, organisations can not only meet their legal obligations but also build greater trust with individuals and strengthen their overall data governance framework.

All organisations must have a process for handling data protection complaints – there are no exemptions. You must provide individuals with a way to make complaints directly to you, and this should be clearly documented in your privacy policy and referenced when responding to a subject access request.

Speak with an expert

If you require further details or advice on updating your data protection policies, please contact us.