From 19 June 2026, organisations across the UK will be required to follow new rules when handling data protection complaints.
The changes, which are being brought in under the Data (Use and Access) Act 2025, are designed to make it easier for people to raise concerns about how their personal information is being collected, used, shared or stored.
Whether you are dealing with a retailer, bank, employer, healthcare provider or technology company, organisations will be expected to take data protection complaints more seriously and respond more clearly.
What is changing?
Under the new rules, organisations must have a process in place for handling data protection complaints.
If you raise a complaint about how your personal data has been handled, the organisation will be required to:
- Provide a clear way for you to complain
- Acknowledge your complaint within 30 days
- Investigate the issue without undue delay
- Keep you informed where appropriate
- Tell you the outcome of their investigation.
The aim is to give people a clearer route for resolving concerns directly with organisations before escalating matters further.
The ICO has published guidance on the new rules, which you can access on its website.
What is a data protection complaint?
A data protection complaint could involve a wide range of issues, including:
- Receiving unwanted marketing communications
- Personal information being shared without permission
- Inaccurate personal data being held about you
- Difficulties accessing information held about you
- Concerns about how your data is being used
- Personal information being exposed in a data breach
- An organisation failing to respond to a data rights request.
Not every complaint will lead to compensation or regulatory action. However, the new rules are intended to ensure concerns are properly considered and addressed.
Why does this matter?
Many people have experienced situations where they feel their concerns about personal data have been ignored or passed between different departments without a clear resolution.
The new requirements should make it easier to understand:
- How to make a complaint
- Who is responsible for dealing with it
- When you can expect a response
- What action the organisation has taken.
Greater transparency could also help identify problems earlier and encourage organisations to improve their data handling practices.
What should you do if you have concerns about your data?
If you believe an organisation has mishandled your personal information, it is usually sensible to raise the issue with them first.
Keep copies of any emails, letters or messages relating to your complaint and make a note of any dates. From 19 June 2026, organisations should have clearer procedures in place to help guide you through the process.
If you remain dissatisfied after receiving a response, you may still be able to escalate the matter to the Information Commissioner’s Office (ICO), which regulates data protection in the UK.
Will this affect data breach compensation claims?
The new rules do not create an automatic right to compensation. However, they may help people obtain clearer information about what has happened to their personal data and how an organisation has responded to their concerns.
In some situations, particularly following a significant data breach, individuals may choose to explore whether they are entitled to seek compensation through legal action. Having a formal complaints process may help establish the facts at an earlier stage.
If you’re concerned about how your data has been handled, you can explore current and potential data breach claims through Join the Claim.
