United Kingdom: Information Commissioner’s Office opened consultation on draft complaints guidance for organisations under Data (Use and Access) Act

On 21 August 2025, the Information Commissioner’s Office (ICO) opened a consultation on draft guidance for organisations on how to handle data protection complaints under the rules introduced by the Data (Use and Access) Act, until 19 October 2025. The Act added a new section, 164A, to the Data Protection Act 2018 to require organisations to provide a way for people to complain, acknowledge receipt within 30 days, investigate without undue delay while keeping the complainant informed, and communicate the outcome promptly. The ICO’s guidance explains what organisations must, should, and could do, offering information for each stage. It stresses the importance of a clear complaints procedure, using plain language, keeping proper records, training staff, and considering additional obligations such as the Equality Act 2010. Special attention is required when dealing with complaints from or on behalf of children, including mechanisms for urgent issues and safeguarding. The guidance sets out how to acknowledge complaints, conduct investigations, maintain records, and provide clear outcomes, including information on the right to escalate complaints to the ICO.