Employment Alert – New Data Protection Complaints Process Required
What’s happening?
From 19 June 2026 amendments to data protection law will require all data controllers to have a formal data protection complaints process in place.
The Data (Use and Access) Act 2025 inserts a new provision into the Data Protection Act 2018 which will give individuals, including employees, workers and job applicants, a legal right to complain directly to the data controller if they believe their personal data has been mishandled. Data controllers will have a corresponding duty to facilitate this right and investigate complaints without undue delay and must comply with connected guidance published by the ICO on 12 February 2026.
Until now, data protection law didn’t require organisations to operate a dedicated complaints process of this kind. From 19 June 2026 organisations must:
- Provide a clear process for individuals to submit data protection complaints
- Facilitate and respond to complaints appropriately
- Follow specific requirements set out in law and ICO guidance
After this change, in most cases the ICO will expect individuals to raise a complaint about the way an organisation has handled their personal data with the organisation directly in the first instance, and will redirect them to do so if no such complaint has been made before a complaint is raised with the ICO.
The requirement will apply to all data controllers with no exemptions.
Why is this important?
All organisations that process individuals data will now need to implement a formal data protection complaints process to comply with this change.
Employers need to be particularly mindful that this change also increases employee rights in relation to data handling. Employers process vast quantities of personal data about their workforce, from recruitment and onboarding through to employee exits. While most employers are accustomed with their obligations in relation to employee privacy notices and managing subject access requests from employees, this change creates a new right for individuals to raise specific complaints regarding personal data handling with their employer.
Subject access requests are increasingly raised by employees as part of wider workplace disputes, often as a negotiating tactic or information gathering tool when an employee is threatening legal action. Whilst not specifically targeted at employee rights, we anticipate employers are therefore equally likely to see complaints from employees under these new rules once implemented. Organisations that cannot demonstrate they have facilitated, acknowledged, investigated, and responded to a data protection complaint in line with the ICO’s guidance may face regulatory scrutiny and enforcement action. Poor or delayed handling of complaints will also increase the likelihood of matters being escalated to the ICO, potentially alongside related employment tribunal claims.
What should you do?
Prepare: Prepare a formal internal data protection complaints process in line with the ICO guidance to address and record complaints.
Implement: Ensure your new complaints process is implemented by 19 June 2026 and take appropriate steps to respond to each complaint without due delay, in line with your process.
Communicate: Communicate the changes internally so staff are aware of the new obligations and identify complaints promptly when they are received.
Take Advice: If you need support with this change, our data protection team have created a practical, ready-to-use Data Protection Complaints Process Pack, delivered on a fixed fee basis, and designed to help you introduce a complaint process quickly, including:
- Template policies
- Staff communications
- Step-by-step guidance aligned with the new law and guidance
If you would like to use our Data Protection Complaints Process Pack or have any questions on how these changes may affect your business please contact our specialist data protection team by emailing [email protected] or [email protected].
All comments and information were accurate at the time of publication and may not reflect current developments. They should not be relied upon without seeking appropriate professional advice.
