From 19 June 2026 businesses must have a formal process in place for individuals to raise data protection complaints directly with them.
The ICO has reminded businesses that they must act now to put their complaints process in place before the new legal requirements come into force.
Our article has a practical guide to what’s changing and how to prepare: Data protection complaints: are you ready? | Womble Bond Dickinson.
The ICO has also issued guidance which explains what businesses must do to comply: How to deal with data protection complaints | ICO.
Businesses need to be aware that the new data protection complaints regime is UK specific; it applies to organisations which are required to comply with UK data protection legislation. The EU GDPR does not require organisations to maintain a formal complaints process.