Complaints guidance for organisations

Closes 19 Oct 2025

Opened 21 Aug 2025

Overview

The Information Commissioner’s Office (ICO) is consulting on draft guidance for organisations handling data protection complaints.

The Data (Use and Access) Act inserts S164A into the DPA18 which means organisations must:

  • give people a way of making data protection complaints to you;
  • acknowledge receipt of complaints within 30 days of receiving them;
  • without undue delay, take appropriate steps to respond to complaints, including making appropriate enquiries, and keep people informed; and
  • without undue delay, tell people the outcome of their complaints.

The guidance aims to walk organisations through the new requirements and inform them of what they must, should and could do to comply. It includes helpful tips and practical advice for each stage in the process.

Your responses will help us to establish if we can provide any additional clarity in the guidance before the final version is published.

We welcome your feedback to the questions set out in this survey. They're split into the following sections: 

Section 1: About you and your organisation.

Section 2: Your views on our guidance.

Section 3: How our guidance will affect you / your organisation. 

Section 4: Any additional comments about the guidance.

The consultation will remain open until 23:59 on Sunday 19 October 2025. We may not consider responses received after this deadline.

Privacy statement 

For this consultation, we may publish in full the responses received from organisations or a summary of the responses. If we do publish any responses, we will remove any personal information, email addresses and telephone numbers from these responses. Please do not to share any information in your response which you would not be happy for us to make publicly available.

Should we receive an FOI request for your response we will always seek to consult with you for your views on the disclosure of this information before any decision is made.

For more information about what we do with personal information please see our privacy notice, and the section on responding to our consultations and surveys.

Please note that we are using the platform Citizen Space to gather this information on our behalf. Citizen Space is provided by Delib. You can read Delib's privacy policy here.

Share your views

Interests

  • Complaints