The new, Statutory Right to Complain: What your organisation needs to know
18th June, 2026
The new, statutory "right to complain" will take effect from 19 June 2026. This new right elevates data protection complaints from an internal process issue to a matter of legal compliance.
All organisations must have a consistent, robust, and well documented complaints framework in place so you:
- give people a way of making data protection complaints to you
- acknowledge receipt of complaints within 30 days of receiving them
- take steps, without undue delay, to respond to complaints
- tell people, without undue delay, the outcome of their complaints
What is the right to complain?
From 19 June 2026, you must give individuals whose data you process including employees and customers, a right to make a formal complaint if they are unhappy with how you are handling their personal data.
While internal complaints processes have long formed part of good governance and risk management, new legislation means these processes will soon become a regulatory obligation.
The ICO has issued guidance which explains what organisations need to do to meet the requirements under the new, statutory right to complain. Organisations must:
- Have a clear process for making a data protection complaint. This could be via a complaints form or online portal, a dedicated email address, or you may allow people to make a complaint over the phone or in person. Whatever your chosen method is, it must be clearly documented so that people are aware of their right at the point at which they share their personal information with you. You could do this by including the right to complain in your privacy policy and on any online or paper forms where people provide their data to you.
- Accept and acknowledge receipt of the complaint within 30 days. The 30 days starts on the day after you receive the complaint, regardless of whether that day is a weekend or public holiday.
- Investigate the complaint “without undue delay”. In other words, take appropriate steps to respond to complaints, including making appropriate enquiries and gathering relevant information, without an unjustifiable or excessive delay. There is no set time frame for you to carry out this investigation but the words “without undue delay” do mean you should be taking steps as soon as you receive the request.
- Keep complainants informed and tell them the outcome of their complaint, without undue delay.
What does the right to complain mean for your organisation?
Under the new regime, informal or inconsistent approaches to complaints may no longer be sufficient; organisations that treat complaints as a compliance afterthought face increased regulatory and litigation risk as well as potential reputational damage. The new right imposes a new statutory obligation on you to deal with complaints. However, if the individual is not satisfied with the way you have handled the complaint, we suggest you should make it clear that the next stage of their complaint is to go to the ICO.
What should you do?
Organisations will be expected to be able to demonstrate that complaints are handled fairly, consistently, and transparently, with clear procedures and decision‑making structures in place. You should therefore focus on developing a clear approach to handling data protection complaints and assign responsibility to relevant members of staff within your organisation to ensure that complaints are picked up promptly and investigated appropriately.
You should also review your current data protection policies and procedures and consider whether any updates or improvements are required in light of the new right to complain coming in. For example, does your privacy policy inform people of their right to complain and include details about making a data protection complaint? Although there is no specific obligation for you to have a written policy or procedure, you should consider having a complaints policy that sets out your organisation’s complaints procedure as this will help you demonstrate compliance with this new obligation.
If you would like to discuss the new right to complain or the documentation and procedures you should have in place to help you comply with this new requirement, please contact Phil Tompkins.
Please note that this briefing is designed to be informative, not advisory and represents our understanding of English law and practice as at the date indicated. We would always recommend that you should seek specific guidance on any particular legal issue.
This page may contain links that direct you to third party websites. We have no control over and are not responsible for the content, use by you or availability of those third party websites, for any products or services you buy through those sites or for the treatment of any personal information you provide to the third party.
