Your Data Complaint Just Got a Legal Upgrade: What UK Businesses Must Do Now

What Changed on June 23, 2026?

As of June 23, 2026, the UK's data protection complaint handling rules got a serious facelift. The ICO now requires organisations to follow specific legal steps when someone files a complaint about their personal data. Think of it as moving from a vague suggestion box to a formal, legally-binding process.

Featured Snippet Bait: Under the new rules, organisations must acknowledge a data protection complaint within 5 working days, investigate it thoroughly, and provide a substantive response within 30 calendar days. Failure to comply can result in enforcement action by the ICO.

Why This Matters for Your Business

If you handle personal data in the UK, this isn't just another compliance checkbox. The new requirements turn complaint handling into a legal obligation with teeth. Ignoring them is like ignoring a parking ticket—except the fine is much bigger and comes with reputational damage.

Let's be honest: dealing with complaints is about as fun as reading the terms and conditions of a free app. But now, it's legally mandated fun. So grab a coffee (or something stronger) and let's break down what you need to do.

Key Requirements at a Glance

• Acknowledge within 5 working days: Send a confirmation that you've received the complaint.
• Investigate promptly: Look into the issue with a clear process.
• Respond within 30 calendar days: Provide a detailed answer, including any actions taken.
• Document everything: Keep records of complaints and how they were handled.
• Review and improve: Use complaints to fix systemic issues.

Practical Steps to Comply

Update Your Privacy Policy

Your privacy policy should now include a clear section on how to make a complaint and what happens next. Make it easy to find—not buried in legalese.

Train Your Team

Everyone from customer service to the CEO needs to know the new rules. Run a short training session. Yes, even the CEO. Especially the CEO.

Set Up a Tracking System

Use a simple spreadsheet or dedicated software to log complaints, deadlines, and responses. Missing a deadline is now a legal risk.

What If You Don't Comply?

The ICO can issue enforcement notices, fines, or even ban you from processing data. Plus, unhappy customers might take you to court. It's a lose-lose situation. So better to comply now than explain later why you didn't.

For more details, check the official ICO guidance on complaints.

FAQ