A new legal right allowing employees and other individuals to raise data protection concerns directly with organisations took effect on 19 June 2026. The Data (Use and Access) Act 2026 (DUAA) requires organisations to put formal arrangements in place for receiving and handling these complaints. In practice, organisations must:
- Offer a clear route for individuals to raise data protection concerns.
- Confirm receipt of a complaint within 30 days.
- Take reasonable steps to investigate and respond promptly.
- Inform the individual of the outcome without unnecessary delay.
This marks a notable change. Previously, many data protection issues were taken straight to the Information Commissioner’s Office (ICO). Now, employers must be able to demonstrate that they have robust internal procedures for identifying, investigating and resolving concerns. An employee may raise a complaint if they believe their employer has mishandled their personal data. Issues may include:
- The way the employer dealt with a subject access request or other data rights request.
- The adequacy of security measures protecting their information, including where a data breach has occurred (whether or not it is reportable to the ICO).
- How their personal data has been collected, used, stored, retained or kept up to date.
Employees do not need to use legal terminology, refer to the DUAA, or explicitly label their concern as a “complaint”. Employers also do not need a standalone complaints system. Data protection complaints can be incorporated into existing processes—such as grievance procedures—provided the employer can still meet its obligations, including timely investigation and response.
Employers must inform employees, at the point of collecting their personal data, that they have the right to complain directly to the organisation. This is typically done through the employee privacy notice. Employers should also identify who within the organisation will handle these complaints and ensure staff can recognise when a data protection issue has been raised and know how to escalate it. Training should cover the complaints process as part of wider data protection responsibilities.
If an employee is dissatisfied with the employer’s response, or if the employer fails to address the matter, the complaint can then be taken to the ICO. The ICO has issued guidance to help organisations comply with these new duties.
Consequences of non‑compliance
- Greater ICO attention: Frequent escalations may prompt broader regulatory scrutiny, as seen in recent enforcement activity.
- Employment relations risks: Mishandled complaints may lead to grievances or tribunal claims, particularly where issues relate to monitoring, disciplinary processes or data breaches.
- Reputational damage: Public enforcement action or high‑profile complaints can harm an employer’s reputation.
Immediate actions for employers
Employers should now:
- Review current procedures to ensure they can meet the statutory deadlines.
- Update employee privacy notices to reflect the new right to complain.
- Allocate responsibility for managing data protection complaints.
- Train managers and relevant staff to identify and escalate complaints appropriately.
- Prepare template acknowledgement and response letters.
- Put in place a system for logging complaints and tracking deadlines.
Philip McCabe, 24 June 2026