In force since 19 June 2026
Section 164A: the UK's data protection complaints duty
Section 164A of the Data Protection Act 2018 lets people complain to you directly about how you handled their personal data. You must make complaining easy, acknowledge every complaint within 30 days, investigate it and tell the person the outcome.
It was inserted into the DPA 2018 by section 103 of the Data (Use and Access) Act 2025, along with section 164B. It applies to complaints received on or after 19 June 2026. There are no exemptions by size or sector.
Does this apply to me?
If you decide why and how personal data is processed, you are a controller and section 164A applies to you. There is no threshold for size, turnover or sector.
- Sole traders and freelancers
- Small businesses and SMEs
- Charities and community groups
- Schools and academy trusts
- Clubs, societies and associations
- Public bodies, including Part 3 processing
Processors do not carry the duty themselves, but they hold records controllers need. Read who section 164A applies to.
The four core obligations
Guides
- What is section 164A of the Data Protection Act 2018?Section 164A of the Data Protection Act 2018 makes controllers handle data protection complaints: facilitate them, acknowledge within 30 days, respond without undue delay.
- Who does section 164A apply to?Section 164A applies to every UK controller with no exemptions by size or sector: sole traders, SMEs, charities, schools, clubs and public bodies. Processors have a supporting role.
- The 30-day acknowledgement rule under section 164A(3)Section 164A(3) requires controllers to acknowledge a data protection complaint within 30 days of receipt. When the clock starts, what to say, and whether automated acknowledgements count.
- How to handle a data protection complaint, step by stepA nine-step data protection complaints procedure for section 164A: receive, log, acknowledge within 30 days, investigate, update, decide, inform the outcome, signpost the ICO and record.
- What counts as a data protection complaint?A section 164A complaint is any expression of dissatisfaction about the handling of a person's own personal data, in any channel. How to tell a complaint from a query or a subject access request.
- What does without undue delay mean in section 164A?Section 164A(4) requires controllers to respond to data protection complaints without undue delay. There is no fixed deadline. How to set an internal target and defend it.
- Section 164B: the complaints reporting powerSection 164B of the DPA 2018 lets the Secretary of State require controllers to report complaint numbers to the Commissioner. No regulations are in force yet. What to prepare.
- Section 164A and complaints to the ICO under section 165How section 164A complaints to the controller sit alongside section 165 complaints to the ICO, what changed when Article 77 UK GDPR was omitted, and the escalation routes.
- The Data (Use and Access) Act 2025 complaints reformsSection 103 of the Data (Use and Access) Act 2025 inserted sections 164A and 164B into the DPA 2018, omitted Article 77 UK GDPR and amended Articles 12 to 15. What changed on 19 June 2026.
- What happens if you ignore section 164A?What actually happens if you ignore the section 164A data protection complaints duty: complaints to the ICO, information and enforcement notices, and the realistic risk for a small organisation.
Templates
- Data protection complaints policy templateA free copy-and-paste data protection complaints policy for a small organisation, written for section 164A of the DPA 2018 with the 30-day acknowledgement built in.
- Privacy notice wording for section 164AExact wording to add to your privacy notice and to subject access request responses to meet the section 164A signposting duties under amended UK GDPR Articles 12 to 15.
- Data protection complaint form templateThe fields a section 164A data protection complaint form should capture and why, with copy-and-paste form text for a small organisation.
- Data protection complaints log templateWhat to record for every data protection complaint under section 164A, and why a countable record matters if section 164B reporting regulations are made.
Guidance by sector
Reference
Primary sources
- Data Protection Act 2018, section 164A
- Data (Use and Access) Act 2025, section 103
- ICO, How to deal with data protection complaints (12 February 2026, updated 8 May 2026)
Last reviewed: 16 September 2026. 23 reference pages on this site.
Prove you met the duty, not just that you meant to
The work in section 164A is operational: spotting the complaint, dating it, acknowledging it within 30 days, keeping the person informed and recording the outcome. PrivacyComplaints does that part for small organisations.