Most businesses that are involved in processing personal data will be aware of the rights of individuals to make Data Subject Access Requests to obtain copies of the personal information the business holds about them. This is one of several rights of individuals relating to their personal information under the General Data Protection Regulation (GDPR).
From 19th June 2026, individuals whose data is processed by an organisation will have a new right under the Data Use and Access Act (the Act) to complain directly to the organisation about the processing of their personal information and businesses will need to have a formal process in place for facilitating and dealing with such complaints. The obligation applies to all businesses regardless of size or sector.
There is a wide range of complaints which can be made by individuals under the Act including but not limited to complaints relating to the legal basis for the processing of their data, how their information was collected or has been used or shared, failures to protect their information or to respect any of their rights under the GDPR. This could include complaints about the handling of a Subject Access Request.
As is the case with Subject Access Requests, a complaint does not need to be specifically labelled as such for the obligation to arise so businesses will need to have procedures in place to identify any communication that might be classified as a complaint. When a complaint is received it must be acknowledged within not more than 30 days. The business must then without undue delay investigate the subject of the complaint and notify the individual of the outcome of their complaint and of their right to escalate the matter to the Information Commissioner if they are not satisfied with the response to the complaint.
Steps which businesses should take in preparation for the new rules coming into force include employee training and putting in place mechanisms for receiving complaints and procedures for dealing with them. Privacy policies should be updated to refer to the right to complain. Arrangements with any data processors may also need to be reviewed to ensure their co-operation in notifying businesses of complaints and responding to them. Records should be kept to demonstrate compliance with the legislation and to identify trends in complaints which might indicate a need to make changes to the business’s policies or procedures for handling personal information.
How we can help
If you have any questions or would like advice in relation to the new rules or data protection generally, please contact Julian Milan at julian.milan@mfgsolicitors.com or call 0121 2367388.