Who does section 164A apply to?
Section 164A applies to every controller. There are no exemptions by size, turnover or sector. If you decide why and how personal data is processed, the duty applies to you from the first complaint you receive.
The test is whether you are a controller
Section 164A places the duty on the controller. A controller is the organisation or person that determines the purposes and means of processing personal data. If you decide what customer data to collect, how long to keep it and who to share it with, you are the controller of that data. Nothing else about you matters for this duty.
Worked through by organisation type
| Organisation | Applies? | What it usually means in practice |
|---|---|---|
| Sole trader or freelancer | Yes | One published route, a simple log, and an acknowledgement template you can send from your phone |
| Small business under 10 staff | Yes | Name one owner of complaints, make sure the shared inbox is checked, keep the log where cover staff can find it |
| Charity or community group | Yes | Donor and beneficiary complaints both count. Volunteers need to know how to pass one on |
| School, academy or trust | Yes | Data protection complaints must not be lost inside the general parental complaints procedure |
| Club, society or association | Yes | Membership lists and photos are the common source of complaints |
| Public body | Yes | Includes Part 3 law enforcement processing as well as UK GDPR processing |
| Processor acting for someone else | Not directly | The duty sits with the controller, but your contract and your speed decide whether the controller can meet it |
If you would rather not run this from a spreadsheet and a shared inbox, use complaint logging software that timestamps receipt, acknowledges automatically and keeps a section 164A complaints log you can hand to the ICO.
Processors
Section 164A does not place the complaints duty on processors. In practice processors are pulled in constantly, because the facts often sit in their systems. If you are a processor and a complaint reaches you, pass it to the controller straight away and date-stamp when you did. If you are a controller using processors, your contracts should require prompt notification and cooperation, otherwise you will miss deadlines that are legally yours.
Joint controllers
Where two organisations jointly determine purposes and means, both are controllers, and a complaint can be brought to either. Decide in advance who acknowledges, who investigates and who sends the outcome, and record that arrangement. A complainant should not have to referee it.
You are a controller of more than customer data
Complaints regularly come from people who are not customers at all: job applicants, former employees, suppliers' staff, website visitors, people captured on CCTV, people whose data you bought from a list broker. All of them are data subjects. A recruitment agency's biggest section 164A exposure is usually candidates, not clients. See recruitment agencies and landlords and letting agents for typical patterns.
What if you never receive a complaint
The duty to facilitate complaints under 164A(2) and the signposting duties in the amended Articles 12 to 15 apply whether or not anyone complains. So the minimum work is: publish a route, publish the wording, and be ready. The acknowledgement and response duties only bite when a complaint arrives.
Prove you met the duty, not just that you meant to
The work in section 164A is operational: spotting the complaint, dating it, acknowledging it within 30 days, keeping the person informed and recording the outcome. PrivacyComplaints does that part for small organisations.