With effect from 19 June 2026 the Data (Use and Access) Act 2025 introduces a new statutory right for employees and other individuals to raise data protection complaints directly with their employer.
Individuals do not need to use legal terminology or to even reference the word ‘complaint’.
A simple statement like “I don’t want you to use my data in that way” will suffice to trigger the employers’ new obligations.
Organisations are now under a positive obligation to deal with data protection complaints. This means that they must:
- Provide a mechanism whereby complaints can be made about their data.
- Acknowledge complaints within 30 days.
- Take steps to respond without undue delay.
- Inform the person complaining of the outcome of their complaint without undue delay.
A failure to comply with the new act could amount to a breach of data protection law.
Before this legislation it was to the Information Commissioner’s Office (ICO) that most complaints were addressed. As is common with many Government funded bodies the level of overwhelm at the ICO when dealing with complaints was excessive. Anyone who has ever complained to the ICO will know how long it can take and that is even if they accept to investigate anything other than the most significant breaches of the GDPR. This Act is designed to move that onus back onto employers and to ensure they have effective systems for receiving complaints, looking into them and resolving them internally, if at all possible.
Useful guidance for employers is available from the ICO website here. Employees wanting to complain may also find this useful in pointing out where their employer has fallen short.
This blog was written by Beatrice Young, Solicitor at didlaw.
