Section 164A and complaints to the ICO under section 165
Section 164A is the complaint to you. Section 165 of the DPA 2018 is the complaint to the Information Commissioner. Article 77 of the UK GDPR was omitted on 19 June 2026, so the regulator route now sits in section 165(2). People can still go straight to the ICO.
Two routes, not a hierarchy
Since 19 June 2026 a data subject has two clear statutory routes. They can complain to the controller under section 164A, and they can complain to the Information Commissioner under section 165(2) of the DPA 2018. Nothing requires them to use yours first.
| Section 164A | Section 165 | |
|---|---|---|
| Complaint goes to | The controller | The Information Commissioner |
| Must the person come to you first? | No | No |
| Fixed deadline | Acknowledge within 30 days | The Commissioner's own service standards apply |
| Outcome | Your decision, communicated to the complainant | Regulatory outcome, which can include action against you |
| Your obligation | Facilitate, acknowledge, investigate, inform | Cooperate with the ICO |
What changed when Article 77 was omitted
Article 77 of the UK GDPR gave the right to lodge a complaint with a supervisory authority. It was omitted on 19 June 2026 and the equivalent right now sits in section 165(2) of the DPA 2018. In practical terms the right is unchanged. What changed is the citation, so privacy notices, policies and template letters that quote Article 77 are now out of date. Fix them with the privacy notice wording.
The ICO's expectation about coming to you first
The ICO has said it will usually ask a complainant to raise the matter with the organisation first. That is an expectation about how the regulator handles its own caseload, not a legal precondition. Two consequences follow for you. First, more complaints will land with you rather than at the ICO. Second, when a complaint does reach the ICO, your handling of it is part of what the regulator looks at.
Escalation routes in order
- 1Complaint to you under section 164AYou acknowledge within 30 days, investigate and inform the outcome without undue delay.
- 2Your internal review, if you offer oneOptional. A single review stage is often enough to resolve dissatisfaction with the outcome rather than the facts.
- 3Complaint to the ICO under section 165The complainant can do this at any point, including before contacting you. Signpost it in every outcome letter.
- 4ICO assessment and any regulatory actionThe ICO may ask you for your records. Your log, dates and correspondence are the answer.
Always signpost the ICO
Include the regulator route in your acknowledgement and in your outcome message. Withholding it looks like an attempt to contain the complaint, and it is one of the easiest things for a complainant to raise with the ICO.
ICO signposting wording
If you are not satisfied with our response, you can complain to the Information Commissioner's Office. You can do this at any time, and you do not have to complain to us first. Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF ico.org.uk/make-a-complaint
When a complaint reaches the ICO
Expect to be asked what the complaint was, when you received it, when you acknowledged it, what enquiries you made, and what you told the complainant. Answering that in a day with a complete file is a very different experience from spending a week searching mailboxes. That gap is the argument for keeping a section 164A complaints log in one place.
Prove you met the duty, not just that you meant to
The work in section 164A is operational: spotting the complaint, dating it, acknowledging it within 30 days, keeping the person informed and recording the outcome. PrivacyComplaints does that part for small organisations.