The Data (Use and Access) Act 2025 complaints reforms
Section 103 of the Data (Use and Access) Act 2025 inserted sections 164A and 164B into the Data Protection Act 2018. Together with the omission of Article 77 of the UK GDPR and amendments to Articles 12 to 15, it moved complaint handling from good practice to statutory duty on 19 June 2026.
The changes in one list
- New section 164A DPA 2018. A statutory duty to facilitate, acknowledge within 30 days, investigate and respond to data protection complaints.
- New section 164B DPA 2018. A power for the Secretary of State to require controllers to report complaint numbers to the Commissioner. Not yet exercised.
- Article 77 UK GDPR omitted. The right to complain to the regulator now sits in section 165(2) of the DPA 2018.
- Articles 12, 13, 14 and 15 UK GDPR amended. Controllers must tell people about the section 164A right in privacy notices and in responses to subject access requests.
Before and after
| Question | Before 19 June 2026 | Now |
|---|---|---|
| Must you run a complaints process? | Good practice only | Yes, statutory duty under section 164A |
| Deadline to acknowledge | None | 30 days from receipt |
| Deadline to respond | None | Without undue delay |
| Where is the right to complain to the regulator? | Article 77 UK GDPR | Section 165(2) DPA 2018 |
| Must privacy notices mention complaining to you? | No | Yes, via amended Articles 13 and 14 |
| Must you report complaint numbers? | No | Not yet. Section 164B power exists |
If you would rather not run this from a spreadsheet and a shared inbox, use complaint logging software that timestamps receipt, acknowledges automatically and keeps a section 164A complaints log you can hand to the ICO.
Why the reform happened
The regulator received large volumes of complaints that organisations could have resolved themselves, often because the complainant had no obvious way to raise the issue directly. Putting a duty on controllers, and pairing it with an expectation that people try the organisation first, pushes routine complaints to the place best able to fix them quickly.
What you should have done by now
- Published a complaints route that works electronically and by another means.
- Updated your privacy notice with the section 164A wording and removed references to Article 77.
- Updated your subject access request response template with the same signposting.
- Adopted a written complaints procedure with named owners and internal targets.
- Started logging every complaint with its receipt date in a countable record.
If any of those are outstanding, the complaints policy template and privacy notice wording pages are the quickest way to close the gap.
Read the source
- Data (Use and Access) Act 2025, section 103
- Data (Use and Access) Act 2025, contents
- Data Protection Act 2018, section 164A
- ICO, How to deal with data protection complaints
Prove you met the duty, not just that you meant to
The work in section 164A is operational: spotting the complaint, dating it, acknowledging it within 30 days, keeping the person informed and recording the outcome. PrivacyComplaints does that part for small organisations.