Privacy notice wording for section 164A
The DUAA reforms amended Articles 12, 13, 14 and 15 of the UK GDPR, so you must tell people about the section 164A right to complain to you in your privacy notices and in your responses to subject access requests. Two short paragraphs cover it.
What the signposting duty requires
You have to make the section 164A right visible where people already look: your privacy notice, and the response you send to a subject access request. The wording is not prescribed. What matters is that a reader learns they can complain to you, how to do it, and that they can also complain to the Information Commissioner.
Privacy notice wording
Add to your privacy notice, under Your rights
Complaining to us If you think we have handled your personal data incorrectly, you can complain to us directly under section 164A of the Data Protection Act 2018. You can use our complaint form at [URL], email [email address], write to us at [postal address] or call [number]. You do not need to use a particular format, and you do not need to refer to the law. We will acknowledge your complaint within 30 days of receiving it, make enquiries into it, keep you informed of progress and tell you the outcome without undue delay. Our data protection complaints policy at [URL] explains the process in full. Complaining to the Information Commissioner You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint. You can do this at any time and you do not have to complain to us first, although the ICO will usually ask you to raise the matter with us before it looks at your complaint.
Subject access request response wording
Article 15 was amended too, so your SAR responses need the same signposting. Add this to the end of your standard response letter.
Add to your subject access request response
Your right to complain If you are unhappy with how we have handled your request or with the way we process your personal data, you can complain to us under section 164A of the Data Protection Act 2018. Contact [name, role] at [email address] or write to [postal address]. We will acknowledge your complaint within 30 days of receiving it and tell you the outcome without undue delay. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint at any time.
Wording to remove
| Old wording | Replace with |
|---|---|
| You have the right to lodge a complaint with a supervisory authority under Article 77 of the UK GDPR | You can complain to the Information Commissioner's Office under section 165 of the Data Protection Act 2018 |
| If you have a concern, please contact us and we will try to help | A named route, an electronic option, another means, and the 30-day acknowledgement commitment |
| We aim to respond to all enquiries within 30 days | Separate the 30-day acknowledgement from your target for the substantive response |
Prove you met the duty, not just that you meant to
The work in section 164A is operational: spotting the complaint, dating it, acknowledging it within 30 days, keeping the person informed and recording the outcome. PrivacyComplaints does that part for small organisations.