Data protection complaints procedure

The rule: section 164A of the Data Protection Act 2018

Section 164A of the Data Protection Act 2018 gives every person whose personal data an organisation handles a right to complain to that organisation, and puts four duties on the organisation in return. Subsection (1) sets the right: “A data subject may make a complaint to the controller if the data subject considers that, in connection with personal data relating to the data subject, there is an infringement of the UK GDPR or Part 3 of this Act.” Part 3 covers processing for law enforcement purposes; for a school, nursery, charity or care provider the complaint will almost always be about the UK GDPR.

The duties on the controller, the organisation that decides why and how the data is used, are these:

1. Facilitate complaints. “A controller must facilitate the making of complaints under this section by taking steps such as providing a complaint form which can be completed electronically and by other means.” (subsection (2))
2. Acknowledge within 30 days. The controller “must acknowledge receipt of the complaint within the period of 30 days beginning when the complaint is received.” (subsection (3))
3. Respond without undue delay. Subsection (4) says the controller “must without undue delay” “take appropriate steps to respond to the complaint”. Subsection (5) says those steps include “making enquiries into the subject matter of the complaint, to the extent appropriate”, and “informing the complainant about progress on the complaint”.
4. Give the outcome without undue delay. Under the same subsection (4), the controller must, without undue delay, “inform the complainant of the outcome of the complaint”.

The section was inserted by section 103 of the Data (Use and Access) Act 2025 and came into force across the UK on 19 June 2026 under regulation 3 of the Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (S.I. 2026/82). Regulation 7 limits the two clocks to new complaints: the duties in section 164A(3) and (4) “apply only in relation to a complaint that is received by the controller on or after the 19th June 2026.”

The regulator has been the Information Commission since 30 September 2026, when S.I. 2026/1015 brought into force the abolition of the office of Information Commissioner and the transfer of its functions; it still calls itself the ICO. Its guidance How to deal with data protection complaints, first published on 12 February 2026 and last updated on 8 May 2026, opens: “You must have a process for handling data protection complaints within your organisation”, and adds “there are no exemptions to this.”

The duty is enforceable. Schedule 10 to the Data (Use and Access) Act 2025 adds a controller that “has failed, or is failing, to comply with section 164A” to the grounds for an enforcement notice under section 149 of the 2018 Act, extends penalty notices to the same failure, and sets the cap for it in a new section 157(4A): “the maximum amount of the penalty that may be imposed by a penalty notice is the standard maximum amount.”

What counts as a data protection complaint

A complaint is within section 164A when the person says the organisation has broken data protection law in handling their own personal data, or the data of someone they are acting for. The ICO's chapter What are data protection complaints? stresses that the complainant need not frame it that way: “In order to complain, they don’t have to use legal terms or quote sections of the legislation.” Its examples are complaints about:

• “the way you’ve responded to their subject access request (SAR), or other rights request;”
• “the security measures you’ve used to store their information (eg someone who has been impacted by a data breach, regardless of whether it’s reportable to us); or”
• “how you’ve collected or used their personal information (eg where you’ve stored it, how long you’ve kept it for, or its accuracy).”

In the four sectors this guide covers, that looks like a parent who says a class photograph of her son was posted where she had asked it not to be; a resident's son who says a carer told a neighbour about his mother's diagnosis; a volunteer who says the charity passed her contact details to another organisation; or a parent who says an accident form about her daughter went to another family. None of them will say “section 164A”. Each is a data protection complaint, and so is a complaint about how a subject access request was answered.

Not every complaint that mentions personal information is one. The ICO says a complaint about service that comes with a rights request “doesn’t count as a data protection complaint”, and gives two examples: an employee who raises a grievance and also asks for copies of their personal information, and a person who complains about customer service and also asks for their information to be deleted. The grievance and the service complaint go through their own procedures; the request is a rights request with its own clock. Where it is unclear, the ICO's answer is simple: “If you’re not sure whether someone is making a data protection complaint, you should ask them to clarify.”

Three checks come before any investigation, all from the ICO's chapter How do we prepare to handle data protection complaints?:

• Identity, only if in doubt. “If you have sufficient information to be satisfied about the requester’s identity, you must not request more information.” A parent the school office has known for years does not need to send a passport.
• Authority, when someone complains for another person. A family member, solicitor or advocate needs evidence such as a power of attorney or a signed letter of authority, and “If you have no evidence that a third party is authorised to act on someone’s behalf, you must not investigate the complaint until you receive the appropriate authority.” The checks you already use for subject access requests usually serve.
• Children. A pupil or a young person in a charity's service can complain in their own right. The ICO says “You must assess the competence of the child to understand and exercise their rights”, and “If you receive complaints from children, you should respond in plain, clear language they can understand.”

How people complain, and what you must tell them

The complaint form in section 164A(2) is an example, not a requirement: the Act says “steps such as” a form. The ICO puts it plainly: “You must give people a way to make data protection complaints directly to you. How you do this is up to you”, and lists a complaint form submitted electronically or in writing, an email address, the phone, an online portal, live chat with a route to a person, or in person. A small nursery or charity can meet the duty with an email address, a phone number and a paper form at reception.

Whatever route you publish, people will use others. The ICO says: “Although you can invite people to use your set process, there’s no obligation for them to do this. People can complain in any way they choose, including through other channels. For example, they may contact any of your employees, or any part of your organisation.” And: “However you receive a complaint, you must accept it.” A complaint made to a teaching assistant at the gate, a care worker on a visit or a volunteer at a drop-in is one the organisation must accept. Complaints on social media count too, but the ICO warns that “In general, responding on social media is not a secure way of providing information. You should ask for an alternative contact method instead.”

That makes training the real control. The ICO says “You should ensure all staff can recognise a data protection complaint and know what to do if they receive one”, including where to send it; “It’s up to you to decide who is best placed in your organisation to handle data protection complaints”, which is often the data protection officer where there is one.

The law also says where people must be told about the right. Schedule 10 to the 2025 Act inserted it into UK GDPR from 19 June 2026:

• Privacy notices: Article 13(2)(ca) and Article 14(2)(da) add “the right to make a complaint to the controller” under section 164A to what a privacy notice must say.
• Subject access responses: Article 15(1)(ea) adds “the right to make a complaint to the controller under section 164A of the 2018 Act” to the information given with a subject access response.
• Refusals: when a controller does not act on a rights request, Article 12(4) requires it to give its reasons and to explain “the possibility of making a complaint to the controller under section 164A of the 2018 Act, making a complaint to the Commission under section 165 of that Act and seeking a judicial remedy.”

The ICO sums this up as “You must tell people they can complain to you, as well as to us”, at the point you collect their information and when you answer a subject access request. For schools in England, the Department for Education's DUAA compliance checklist for schools (replaced on 14 October 2026) says “Schools must have a clear process for handling data protection complaints” and lists “update privacy notices to explain how people can make a complaint”. While the notices are open, replace any reference to the Information Commissioner with the Information Commission. The privacy notice for schools, charity privacy notice and care home privacy notice guides cover the rest of each notice.

The clocks: 30 days to acknowledge, then without undue delay

Section 164A runs two clocks, and only the first has a number. The ICO's chapter What do we do when we receive a complaint? explains how the 30 days are counted: “The 30 days start the day after you receive the complaint”, weekends and public holidays included, and “If the last day to acknowledge the complaint falls on a weekend or public holiday, you have until the next working day to provide an acknowledgement.” Its worked example: a complaint received on Thursday 5 June has 30 days ending on Saturday 5 July, so the acknowledgement is due by the end of Monday 7 July.

The acknowledgement can be short: “the important thing is that you confirm you’ve received it and you’ll look into it.” The ICO suggests that “it’s likely to be most practical to follow the method the complainant has used”, accepts automatic email replies, and says a complaint made by phone or face to face can be acknowledged on the spot and followed up in writing. If you are already in touch to ask for identification, that contact usually serves as the acknowledgement.

Schools need one more line in the procedure. The ICO says: “If you have staff absence for certain periods of the year (eg school holidays or sickness), you must make arrangements for acknowledging data protection complaints during these times.” A complaint emailed in the last week of July cannot wait for September; somebody has to be checking.

Everything else runs on “without undue delay”, which the ICO glosses as “without an unjustifiable or excessive delay”. Three points from its guidance shape the procedure:

• The investigation starts at once. “Your obligation to investigate begins when you receive the complaint, not after the 30-day acknowledgement period.”
• No blanket period. What counts as undue delay depends on the complexity, the scale and any harm the complainant is suffering; the ICO says the important thing is to consider all the circumstances, “not to apply a set period of time as a blanket approach.”
• A target is a ceiling, not a licence. You may set your own guideline timeframe, but “If you can complete the data protection investigation in a shorter amount of time than your guideline, you must do that.”

While the investigation runs, “You must keep the person making the complaint updated on the progress of the investigation without undue delay”: in practice, the expected timescale and any reason for delay. Where the matter is simple, one reply can do everything; the ICO says that if you can give an outcome within 30 days, “you’re not required to provide an acknowledgement and outcome separately.”

Most organisations in these sectors already have a complaints procedure with its own clock, and the ICO is clear that this is where the data protection complaint should live: “There’s no obligation to produce a separate or standalone process for data protection complaints. You can integrate data protection complaints into your existing processes, as long as you can continue to meet your data protection obligations.” The friction comes where clocks differ:

• a school's complaints procedure sets its own stages and time limits, often ending in a panel weeks later (school complaints policy);
• a nursery or childminder in England works to the EYFS rule for written complaints, with its own 28 days (nursery complaints procedure);
• a care provider registered with the CQC in England runs the complaints system that Regulation 16 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 requires (care home complaints procedure);
• a charity's own procedure sets whatever stages its trustees chose (complaints procedure for a charity);
• a subject access request has its own clock under Article 12(3) and Article 12A of UK GDPR, without undue delay and within one month, which can be extended by two further months where requests are complex or numerous, separate from any complaint about it.

None of these replaces section 164A, and the shorter answer wins. When the data protection point sits inside a wider complaint, the ICO says: “If you can provide an outcome to the data protection complaint sooner than you can provide an outcome to the other issues, you must do this. Waiting to deal with all the issues at once without justification could cause an undue delay.” A parent's complaint about a teacher's conduct that includes a photograph posted without consent may need its data protection outcome before the panel sits.

The outcome, the complaint log and what comes next

The ICO's chapter What do we do after we’ve finished our investigation? says “you must let the complainant know the outcome without an unjustifiable or excessive delay”, explaining what you did and any action taken. Where you conclude nothing went wrong, the bar is higher, not lower: “If you think that you’ve complied with data protection law, explain this in detail to the complainant.” Answering each point in turn, with evidence where you can, is the ICO's suggested format, and a review stage for people still unhappy is something “You could consider”.

The outcome letter is also the natural place to mention the regulator, though the law does not require it there: “It’s also good practice to let them know they have the right to complain to us and provide them with our contact details. There’s no obligation to do so at this stage”; the ICO adds that you must tell people of the right at other points, such as when you first collect their information.

Keep a record of each complaint. The ICO lists what it expects:

• “the date you received the data protection complaint;”
• “your acknowledgement;”
• “any relevant conversations and documents;”
• “the outcome of the complaint; and”
• “any actions you took as a result of your investigation.”

The reason is evidence: “We, or industry bodies, may ask to see this if a complaint is made about you in the future.” For schools in England the DfE's checklist asks them to “maintain a log of complaints and outcomes”. Counting complaints and noting recurring themes is optional; the ICO says it “will help you to identify potential compliance issues and areas for improvement.” Neither section 164A nor the ICO's guidance sets a retention period for the log; the ICO says only “You must not keep personal information for longer than you need it”, so set one in your data retention policy and write down why.

Two arrangements need checking before a complaint arrives. If you are a joint controller, with a local authority or a partner charity for example, agree who handles complaints, because “The timescale begins as soon as the complaint is received by any of the controllers”. If a processor, such as the supplier of a school's information system or a nursery's online learning journal, may receive complaints, its contract should require it to pass them on and help with the investigation; the ICO says “The processor could help with the administration of complaints, but the obligation to handle the complaint remains with you as the controller.”

A complainant does not have to finish your procedure first. Section 165 of the Data Protection Act 2018 gives a separate right to complain to the Information Commission about an infringement of the UK GDPR or Part 3 or 4 of the Act, and nothing in it makes a complaint to the organisation a condition. In practice, the ICO's page How does the ICO deal with complaints? says: “In most cases, if someone complains to us about the way you’ve handled their personal information, we’ll ask them to raise a complaint with you first.” Its guidance adds that “There’s no obligation for people to wait for you to review your decision before complaining to us. People can complain to us at any point”, and that if someone says they are going to the regulator “there’s no need for you to tell us.” If the Commission does not progress a complaint, section 166 lets the complainant ask the Tribunal to order it to respond or to report progress.

One more power sits beside the duty. Section 164B lets the Secretary of State make regulations requiring controllers to tell the Commission how many section 164A complaints they received. No such regulations were listed on legislation.gov.uk on 9 November 2026, but a log that already counts complaints would make any future return easy.

Where ComplyChat fits, and where it does not

The procedure describes an email address and a form. The first raising of a data protection complaint is more often a message to the person the complainant already knows: a parent texting a teaching assistant on a Sunday evening about a photograph in the class group, a daughter messaging her mother's carer about something said to a neighbour, a volunteer writing to the coordinator in a group chat. Section 164A(3) starts the 30 days “when the complaint is received” without saying received by whom. The ICO says people “may contact any of your employees” and that “However you receive a complaint, you must accept it”, so the safe course, though no rule spells it out, is to treat the day a member of staff received that message as the day the organisation received the complaint. If the message sits on a member of staff's own phone, the log has nothing to point to, and nobody else knows the 30 days may have started.

ComplyChat is not a complaints management system. It does not run the log, count the 30 days or write the outcome letter, and it does not capture or archive WhatsApp or texts on staff phones. If complaints already reach you through a shared inbox someone checks daily and a form, your procedure needs training and a log, not a new product.

Where it helps is the conversation that would otherwise happen on a personal phone. Staff, and parents, families and volunteers added by their mobile number, talk in channels the organisation runs; a mobile number verified by SMS is an identity, so nobody needs an account on the organisation's systems; everyone added is told the channel is on the record and can object or leave; and messages are recorded on the server as they are sent. On paid plans, once the organisation's tenant is connected, those conversations are kept under the retention schedules within its own Microsoft 365 subscription, where the complaint log can point to the message, the acknowledgement and the replies.

A question for the next leadership or board meeting: if a parent or relative complained to a member of staff's own phone last month, where would the 30 days show?

Questions people ask

How long does an organisation have to respond to a data protection complaint?

An organisation must acknowledge a data protection complaint within 30 days of receiving it, and must then, without undue delay, make appropriate enquiries, keep the complainant informed of progress and tell them the outcome, under section 164A(3) to (5) of the Data Protection Act 2018. The Act sets no fixed deadline for the outcome; the 30 days is the acknowledgement clock only, and the ICO says the investigation starts when the complaint is received, not after 30 days.

Do I have to complain to the organisation before going to the ICO?

Not as a matter of law: section 165 of the Data Protection Act 2018 gives a separate right to complain to the Information Commission, and sets no condition that the person complained to the organisation first. In practice the ICO says that “In most cases” it will ask someone to raise the complaint with the organisation first, and that people can complain to it at any point, without waiting for a review.

Does a data protection complaint have to be in writing or on a form?

No. Section 164A(2) requires the organisation to facilitate complaints, giving a form “which can be completed electronically and by other means” only as an example, and the ICO says people “can complain in any way they choose”, including to any employee, and that “However you receive a complaint, you must accept it.”

Is a data protection complaint the same as a subject access request?

No: a subject access request asks for a copy of your own personal data under Article 15 of UK GDPR, while a section 164A complaint says the organisation has broken data protection law in handling it. A complaint about how a subject access request was answered is itself a data protection complaint, and since 19 June 2026 the subject access response must tell people of their right to complain to the organisation (Article 15(1)(ea)).

Do small charities, childminders and care providers need a data protection complaints procedure?

They need a process: section 164A applies to every controller, and the ICO says “You must have a process for handling data protection complaints within your organisation” and that “there are no exemptions to this.” It need not be a separate document; the ICO says there is “no obligation to produce a separate or standalone process”, and a written procedure is something you “could” write.

Do we have to tell a complainant they can go to the ICO?

Yes, at set points: the ICO says “You must tell people they can complain to you, as well as to us” when you collect their information, for example in the privacy notice, and when you respond to a subject access request, and Article 12(4) of UK GDPR requires a refusal of a rights request to mention a complaint to the organisation, a complaint to the Commission and a judicial remedy. In the outcome letter it is not required, but the ICO calls it “good practice” to mention the right to complain to it and give its contact details.

Official guidance and your next step

The law is section 164A of the Data Protection Act 2018, with section 165 for complaints to the Information Commission, the commencement rules in S.I. 2026/82 and the amendments to UK GDPR and the enforcement provisions in Schedule 10 to the Data (Use and Access) Act 2025. The regulator's guidance is How to deal with data protection complaints and its five chapters; for schools in England, the DfE's DUAA compliance checklist for schools sits within Data protection in schools. Quotations are from the pages named as read on 9 November 2026.

This guide covers the UK, with the DfE's checklist for schools in England, and is not legal advice. Early years providers will find the wider picture in GDPR for nurseries and childminders, and charities in charity data protection policy.

Then do one thing: ask three members of staff, picked at random, what they would do if a parent, resident's relative or volunteer told them the organisation had mishandled their information. If the answers differ, or none of them mentions passing it on the same day, that is the first line of your procedure.