Section 164B: the complaints reporting power
Section 164B gives the Secretary of State power to make regulations requiring controllers to tell the Information Commissioner how many data protection complaints they receive. No such regulations are in force, so there is no reporting duty today.
Current status: a power, not a duty
Section 164B was inserted into the Data Protection Act 2018 by section 103 of the Data (Use and Access) Act 2025, at the same time as section 164A. It is a regulation-making power. Until regulations are made and brought into force, no controller has to send complaint numbers to the Commissioner.
What regulations could require
The power is about numbers of complaints received, so the likely shape of any future return is a count over a period, possibly broken down by type or outcome. Read section 164B on legislation.gov.uk for the exact wording rather than relying on a summary.
Why this changes how you keep records now
A pile of emails cannot be counted reliably. A record with one row per complaint can. If you keep complaints in a countable form from the start, a future return is a filter and a total. If you do not, it is a reconstruction project across inboxes, and reconstructions produce numbers you cannot stand behind.
| Record style | Can you count it? | Risk if reporting arrives |
|---|---|---|
| Emails in a shared inbox | No | Undercounting, missed complaints, no defensible total |
| Notes in individual mailboxes | No | Records lost when staff leave |
| Spreadsheet with one row per complaint | Yes, with discipline | Version and access problems |
| Purpose-built complaints log | Yes | Low, if fields are consistent |
Fields to capture now so a future return is easy
- Unique reference and date received.
- Channel it arrived by.
- Category, for example marketing, retention, accuracy, access, security, sharing.
- Date acknowledged.
- Date outcome sent.
- Outcome: upheld, partly upheld, not upheld, withdrawn.
- Whether it was escalated to the ICO.
The complaints log template sets these out in full, with why each field matters.
Prove you met the duty, not just that you meant to
The work in section 164A is operational: spotting the complaint, dating it, acknowledging it within 30 days, keeping the person informed and recording the outcome. PrivacyComplaints does that part for small organisations.