As organisations continue to adapt to recent employment law reforms, attention is now turning to other important changes.
From 19 June 2026, the Data (Use and Access) Act 2025 introduces a requirement for organisations to ensure they have an established data protection complaints process. This requirement is one of a number of changes announced by the the Information Commissionerโs Office (ICO) since June 2025.
It allows employees and applicants for new roles to complain directly to organisations about how their personal data is handled. This means all UK employers and organisations must have appropriate procedures in place to receive, manage and respond to data protection complaints.
Under new legislation, organisations will be required to:
- Provide a clear and accessible process for raising data protection complaints
- Acknowledge complaints within 30 days of receipt
- Investigate concerns without undue delay and keep employees informed throughout the process
- Communicate the outcome of the complaint to the employee
These changes are designed to improve transparency, strengthen trust and help resolve issues before they escalate to regulatory action. Ensuring compliance now will help minimise risk, protect reputation and improve employee and customer confidence.
A robust complaints procedure is no longer good practice โ it is a legal requirement. Reviewing your current data protection procedures and making any necessary updates to ensure you are compliant should be a priority ahead of the implementation date.
If you need support preparing for the new requirements, our experts can help you review your policies, identify any gaps and strengthen your data protection processes so you are ready for the changes ahead. Get in touch to discuss how we can help.
