What happens if you ignore section 164A?
Ignoring section 164A does not trigger an automatic fine. What it does is put you in front of the regulator on the worst possible facts, because failing to acknowledge or respond is easy to prove and hard to explain.
The realistic sequence
- 1The complaint escalatesSomeone who was ignored complains to the ICO under section 165. Being ignored is often the reason they escalate, not the original issue.
- 2The ICO asks you questionsExpect to be asked when the complaint was received, when it was acknowledged, and what you did. Dates decide this conversation.
- 3The ICO forms a view of your practicesOne late acknowledgement with a clear explanation reads as an isolated slip. No process at all reads as a systemic failure.
- 4Regulatory action if it is warrantedThe Commissioner's toolkit includes information notices, assessments, reprimands and enforcement notices requiring you to fix the process.
Why complaint handling failures are different
Substantive data protection questions are arguable. Whether you had a lawful basis, whether retention was proportionate, whether a disclosure was necessary: reasonable people differ. Dates do not. Either you acknowledged within 30 days or you did not. That makes complaint handling failures unusually easy for a regulator to establish and unusually hard for you to defend by argument.
What protects you
- A receipt date recorded for every complaint.
- An acknowledgement sent early and preserved with its send date.
- Notes of enquiries and updates, dated as they happened.
- A written procedure with internal targets you usually meet.
- ICO signposting in your acknowledgement and outcome messages.
Each item is a record rather than an intention. If it exists only as a habit, you cannot show it. That is the argument for a system that tracks the 30-day acknowledgement deadline and keeps the trail for you.
The reputational side
Complainants who are ignored talk publicly. Complaints about being ignored are also the ones that arrive by social media, where the silence is visible. Handling complaints promptly is the cheapest reputation work available, and it now happens to be a statutory duty.
Prove you met the duty, not just that you meant to
The work in section 164A is operational: spotting the complaint, dating it, acknowledging it within 30 days, keeping the person informed and recording the outcome. PrivacyComplaints does that part for small organisations.