UK: New right to complain to organisations for UK GDPR infringement

Why should I read this?

From the 19 June 2026, a new “right to complain” under Section 164A of the Data Protection Act 2018 comes into force. Introduced by amendments within the Data (Use and Access) Act 2025. Individuals will be able to complain directly to controllers (broadly organisations which determine how their personal information is used), if they believe there has been a breach of UK GDPR.

This is a significant change in law which amends the UK GDPR/Data Protection Act 2018 framework in several places to expand an organisation’s obligations under data protection laws. This new right is additional to the existing right to complain to the ICO.

What should I do?

Controllers will become subject to a range of new obligations, and must:

• Tell individuals about this new right at the point when personal information is collected, and separately when responding to a subject access request.

• Provide a clear means for an individual to complain, such as by offering an online form or a dedicated email address.

• Acknowledge the complaint within 30 days of receipt, and investigate the complaint without undue delay. The obligation to investigate is triggered when the complaint is received and not after the 30-day acknowledgement period.

• Keep the complainant informed on the investigation’s progress without undue delay. This will involve providing estimated timeframes, and explaining any delays.

• Inform the complainant of the outcome of the investigation.

Practically, controllers should also update their internal training procedures so staff are aware of the new right and can manage complaints appropriately, alongside ensuring suitable record keeping systems are in place for audit purposes.

What else do I need to know about the new right to complain directly to controllers?

The ICO notes organisations may publish a complaints procedure externally, which is accessible and in plain language. Even if organisations decide not to do this, they should consider creating an internal policy for dealing with complaints.

Importantly, organisations should ensure they have in place processes to recognise and action complaints however received by the organisation. The ICO’s guidance confirms individuals can complain however they choose, even if an organisation has a dedicated complaints process. Particular consideration should be given to the possibility of receiving complaints via social media (if an organisation has a social media presence), or made by children (for which special requirements apply).

What should we do next?

Consider if your organisation is ready to meet its obligations by 19^th June deadline. Get in touch with us for advice on what is needed and putting the necessary policies and processes in place to comply.

Further reading on the new right to complain, and the Data (Use and Access) Act 2025

Our Guide to the UK's Data (Use and Access) Act 2025