10 days to go: Are you ready to meet the new data protection complaints requirement?

Organisations across the UK have just 10 days remaining to put a data protection complaints process in place, before new legal requirements come into force.

Under the Data (Use & Access) Act 2025, amendments to the UK GDPR introduce a clear requirement: organisations must have a formal process for handling data protection complaints in place by 19th June.

This development strengthens individuals’ rights by giving them a direct route to challenge how their personal data is handled. It also introduces new, explicit obligations on controllers, signaling a shift towards greater accountability and transparency in complaint handling.

What the new data protection complaints requirement means

From 19 June, organisations must be able to demonstrate that they:

• Have a documented complaints handling process, specifically covering data protection concerns.
• Provide individuals with a clear and accessible method to submit complaints.
• Acknowledge complaints within 30 calendar days.
• Take appropriate investigative steps without undue delay.
• Keep complainants informed throughout the process.
• Communicate the outcome promptly.

This is not simply a procedural change, it reflects a regulatory expectation that complaints are handled effectively, fairly and transparently.

Practical steps to achieve compliance

With the deadline fast approaching, organisations should prioritise the following actions:

• Document or update your complaints policy to explicitly include data protection matters.
• Ensure processes include proportionate identity verification steps and checks for authority (e.g. power of attorney where applicable).
• Introduce a complaints submission mechanism, such as an online form, and make it easy to find on your website. Note that individuals do not have to use this preferred method and can submit complaints in writing or verbally to anyone within your organisation.
• Deliver targeted staff training so employees can recognise and appropriately escalate data protection complaints.
• Maintain clear records of complaints and investigation steps.

Embedding these practices will not only support compliance but also improve consistency and governance.

Investigating complaints effectively

The requirement to investigate “without undue delay” places emphasis on proportional, well-documented action.

Reasonable investigative steps may include:

• speaking to staff involved in the issue;
• reviewing and comparing internal records with the complainant’s account;
• checking compliance with internal policies, procedures, and privacy notices.

A structured and evidence-based approach will help demonstrate accountability if decisions are challenged by regulators or escalated further.

Why this matters

Failure to implement a compliant complaints process by 19 June could expose organisations to regulatory scrutiny and reputational risk. More positively, a well-designed complaints framework provides valuable insight into systemic issues, strengthens trust and reinforces a culture of accountability.

How Moore Kingston Smith can help

The requirement for a data protection complaints policy is no longer optional, it is a regulatory obligation. Organisations that act now to establish robust, transparent and user-friendly processes will not only meet the 19 June deadline but also enhance their overall data protection maturity.

The message is clear: effective complaint handling is now a cornerstone of responsible data governance.

For further support and guidance, contact our Data protection advisory team: DPadvisory@mks.co.uk