What does without undue delay mean in section 164A?
Section 164A(4) requires you to take appropriate steps to respond and inform the outcome without undue delay. There is no fixed statutory deadline. Delay is judged against the circumstances of the complaint and the nature of your organisation.
Why there is no number
Parliament fixed a deadline for acknowledgement in 164A(3) and deliberately did not fix one for the substantive response. Complaints vary too much. Confirming that a marketing email was sent in error takes an afternoon. Establishing who accessed a record over three years, whether a retention rule failed and what to tell the complainant takes weeks. A single number would be either too short for the hard cases or meaningless for the easy ones.
What makes delay undue
- Time when nothing was happening, especially unallocated time while the file sat with nobody.
- Waiting for a person who was on leave when someone else could have acted.
- Repeating information gathering because the first attempt was not recorded.
- Silence. Even a justified delay looks undue when the complainant heard nothing for two months.
What justifies more time
- The complaint spans several years, systems or third parties.
- You need information from a processor or another controller and have chased it on a record.
- The complainant has raised new points that widen the scope.
- The complaint is genuinely complex on the law and you have taken advice.
Set an internal target and write it down
Because the test is relative, your best defence is a published target that you usually meet, plus a record showing why this complaint took longer.
| Complaint type | Suggested internal target | Update rhythm |
|---|---|---|
| Simple, single issue, facts clear | 20 days from receipt | Once, at the outcome |
| Standard, some enquiries needed | 30 days from receipt | Every 14 days |
| Complex, multiple systems or third parties | 60 days from receipt | Every 14 days with a reason for the extension |
| Exceptional, legal advice or historic records | 90 days from receipt | Every 14 days, with a revised date each time |
How to defend a long case
- Record the date you received the complaint and the date of every action after it.
- Note what you were waiting for at each point, and who you chased.
- Send updates on your stated rhythm, even when there is little to report.
- Give a revised expected date whenever you miss your own target, and explain why.
- Close with an outcome that shows the work: what you checked, what you found, what you changed.
That is an audit trail, and an audit trail assembled after the fact is never as convincing. Complaint logging software builds it as you go, so the timeline is a record rather than a reconstruction.
Where the phrase comes from
Without undue delay is used throughout the UK GDPR, for example in the erasure and rectification provisions and in personal data breach reporting. Its use in section 164A carries the same flavour: act promptly, and be able to explain any gap. Nothing about it suggests a soft obligation.
Prove you met the duty, not just that you meant to
The work in section 164A is operational: spotting the complaint, dating it, acknowledging it within 30 days, keeping the person informed and recording the outcome. PrivacyComplaints does that part for small organisations.