Section 164A for small businesses
Section 164A applies to a five-person business exactly as it applies to a bank. There is no size exemption. What is proportionate is the effort, not the duty: one published route, one named owner, one log.
Does section 164A apply to you?
Any business that decides what customer, employee or supplier data it collects is a controller, whether it has one employee or two hundred.
The complaints you are most likely to get
- Marketing emails to customers who asked to be removed
- Old customer records kept long after the work finished
- Sharing a customer's details with a subcontractor without telling them
- A former employee's file still visible to current staff
- Photos of customers or staff used on the website or social media
Channels to watch
The 30-day clock starts when a complaint reaches your organisation by any route, so every channel below needs a named owner.
- The general enquiries inbox nobody owns during holidays
- The owner's personal work email
- The business phone, including voicemail
- Social media direct messages and public replies
- Word of mouth in person, at the counter or on site
Worked examples
| What arrives | How to treat it |
|---|---|
| A customer replies to a mailing: stop emailing me, I unsubscribed twice | A complaint. Log it that day, acknowledge it, check why the suppression failed, fix it, tell them what you found |
| A supplier's employee asks why their mobile number is on your public quote | A complaint from a data subject who is not your customer. Same duties apply |
| A review names a specific misuse of the reviewer's data and is sent to you as well | Treat the message to you as a complaint. The public review is not the complaint route, but it starts the clock if it reaches you |
A minimum viable process
- Publish a complaints route with an electronic option and another means. Use the complaints policy template.
- Add the section 164A wording to your privacy notice and your subject access request template. Use the privacy notice wording.
- Log every complaint with the date it was received. Use the complaints log template.
- Acknowledge within days, not weeks. See the 30-day acknowledgement rule.
- Investigate, update the person, decide, tell them the outcome and signpost the ICO. See how to handle a data protection complaint.
Prove you met the duty, not just that you meant to
The work in section 164A is operational: spotting the complaint, dating it, acknowledging it within 30 days, keeping the person informed and recording the outcome. PrivacyComplaints does that part for small organisations.