Data protection complaints glossary
Definitions of the terms used across this site, written for people who have to comply rather than for lawyers.
Terms
Controller
The organisation or person that decides why and how personal data is processed. Section 164A places the complaints duty on controllers. See who section 164A applies to.
Processor
An organisation that processes personal data on a controller's instructions, such as a payroll bureau or a hosting provider. Processors have no section 164A duty of their own, but they usually hold the records a controller needs to investigate.
Data subject
The living individual a piece of personal data is about. Only a data subject can bring a section 164A complaint, and only about their own personal data.
UK GDPR
The UK version of the General Data Protection Regulation, which sets the main data protection rules and works alongside the Data Protection Act 2018. Article 77 was omitted from it on 19 June 2026.
DPA 2018
The Data Protection Act 2018. It supplements the UK GDPR and contains Part 3 for law enforcement processing, plus sections 164A, 164B and 165.
DUAA 2025
The Data (Use and Access) Act 2025. Section 103 of it inserted sections 164A and 164B into the DPA 2018. See what the DUAA changed.
ICO
The Information Commissioner's Office, the UK data protection regulator. People can complain to the ICO under section 165(2) of the DPA 2018 at any time, without complaining to you first.
DSAR
A data subject access request: a request for a copy of the personal data an organisation holds about the requester, under Article 15 of the UK GDPR. DSAR responses must now include the section 164A signposting wording.
Without undue delay
The standard in section 164A(4) for responding to a complaint. No fixed number of days. Judged against the circumstances of the complaint and the nature of the controller. See without undue delay.
Acknowledgement
Confirmation that you have received a complaint, required within 30 days by section 164A(3). Separate from, and much earlier than, the substantive response.
Prove you met the duty, not just that you meant to
The work in section 164A is operational: spotting the complaint, dating it, acknowledging it within 30 days, keeping the person informed and recording the outcome. PrivacyComplaints does that part for small organisations.