Section 164A frequently asked questions

Section 164A is the UK's statutory data protection complaints duty. It requires a controller to let people complain about the handling of their personal data, to make complaining easy, to acknowledge a complaint within 30 days of receipt, to take appropriate steps to respond, and to tell the complainant the outcome without undue delay.

Section 164A came into force on 19 June 2026. It applies to complaints received on or after that date. It was inserted into the Data Protection Act 2018 by section 103 of the Data (Use and Access) Act 2025, which also inserted section 164B.

Thirty days, beginning when the complaint is received. That is the only fixed deadline in section 164A. It is an acknowledgement deadline, not a deadline to investigate or resolve the complaint. Aim to acknowledge within a few working days so internal delay does not consume the margin.

No. Section 164A(3) refers to 30 days beginning when the complaint is received, so treat it as calendar days with the day of receipt as day one. There is no working-days concession, no clock stop while you wait for information, and no extension for holidays or staff absence.

When the complaint reaches your organisation, not when someone recognises it as a complaint. An email that sits unread in a general inbox for two weeks was received on the day it arrived. Complaints routed to the wrong department were received on the day they first reached you.

No fixed deadline. Section 164A(4) requires you to take appropriate steps to respond and inform the outcome without undue delay. That is assessed against the circumstances of the complaint and the nature of your organisation. Set a written internal target, publish it, and record why any particular case took longer.

A form is given in section 164A(2) as an example of facilitating complaints, not as a hard requirement. What is not optional is an accessible route: people must be able to complain electronically and by other means. Publishing a form and ignoring complaints that arrive by email or phone fails the duty.

Any expression of dissatisfaction about the handling of that person's own personal data. It does not have to use the word complaint, arrive on your form or cite the law. Complaints by phone, email, post, social media or in person all count and all start the 30-day clock.

Yes. Nothing in section 164A requires a human to send the acknowledgement, and automation is often the safest way to hit the deadline. It must be reliable, so it fires for every channel and records what was sent, and it must be monitored, because an auto-reply on an unwatched inbox breaches the duty to respond.

Yes. There are no exemptions by size, turnover or sector. Sole traders, small businesses, charities, schools, clubs and public bodies all carry the same duties if they are a controller. The expected effort is proportionate to your size, but the duties themselves are not reduced.

The duty sits with the controller, not the processor. In practice processors are involved because the relevant records often sit in their systems. Contracts should require prompt notification and cooperation, because the deadline belongs to the controller even when the facts belong to someone else.

Article 77 was omitted on 19 June 2026. The right to complain to the Information Commissioner now sits in section 165(2) of the Data Protection Act 2018. The right itself is unchanged in substance, but privacy notices and letters that cite Article 77 are now out of date and should be updated.

No. Complainants can go straight to the Information Commissioner under section 165(2) and are not required to raise the matter with you first. The ICO has said it will usually ask them to contact the organisation first, which means more complaints reach you, but it is not a legal precondition.

Yes. The same reforms amended Articles 12, 13, 14 and 15 of the UK GDPR, so you must tell people about the section 164A right to complain in your privacy notices and in your responses to subject access requests. Two short paragraphs, including the ICO route, are enough.

Not today. Section 164B gives the Secretary of State power to make regulations requiring controllers to notify the Commissioner of complaint numbers, and no such regulations are in force. Keep records in a countable form, one row per complaint, so a future return would be straightforward.

A subject access request asks for a copy of personal data under Article 15 and runs to its own one-month deadline. A complaint expresses dissatisfaction about how data was handled and runs to section 164A. One message can be both, in which case run both processes in parallel rather than merging them.

Confirm you have received a data protection complaint and the date of receipt, restate what you understand the complaint to be, give a reference, name who is handling it, indicate when you expect to respond, and mention the right to complain to the ICO. Short and specific beats long and cautious.

It counts, and it was received that day. Write down the date, the person's name and contact details, and what they said in their own words, then pass it to whoever owns complaints the same day. Confirm your understanding back to them in the acknowledgement so the record is agreed early.

You still have to handle it. Section 164A(1) turns on what the data subject considers, not on whether they are right. Log it, acknowledge it within 30 days, make proportionate enquiries, and explain clearly why you have not upheld it. A well-reasoned refusal is a compliant outcome.

You cannot ignore a complaint simply because it is inconvenient. Where someone repeats a complaint you have already answered, you can refer to your earlier response and say you will not investigate again, but record that decision and the reason, and still signpost the ICO route.

There is no automatic fine. Acknowledge immediately, record why it was late, and tell the complainant plainly. The realistic risk is escalation to the ICO, questions about your process, and possible regulatory action such as a reprimand or enforcement notice requiring you to fix it.

Long enough to show compliance and to answer any escalation, commonly around three years, then delete on schedule. State the period in your complaints policy. Remember the log itself is personal data, so restrict access and keep special category detail out of summary fields unless it is essential.

Yes. Any data subject can complain, so employees, former employees, job applicants, contractors, suppliers' staff and website visitors are all covered. For recruiters and employers this is often the largest source of section 164A complaints, well ahead of customer complaints.

Record the date every complaint was received and the date you acknowledged it, in one place, for every complaint. Every duty in section 164A is time-based, so those two dates decide whether you can show compliance months later when the complaint is reviewed.