Consultation on the ICO’s approach to data protection complaint handling

Overview

The Information Commissioner’s Office (ICO) is consulting on draft changes to how we handle data protection complaints. It sets out our proposed framework to assess and determine the extent to which it is appropriate to investigate each complaint. This will allow us to focus on cases where we can have the most impact and improve data protection compliance.

People have a statutory right to lodge a data protection complaint with the ICO if they think there has been an infringement of their data protection rights under the UK GDPR.

In recent years we have seen a significant increase in data protection complaints. In 2023/24, we received 39,721 complaints. In 2024/25 this rose to 42,881 and current forecasts indicate that this could increase to somewhere between 45,000 and 55,000 if the current trend continues.

The ever-increasing demand for our services is impacting our ability to respond quickly and effectively. We want to consider new ways of handling data protection complaints.

The Data (Use and Access) Act (DUAA) places new requirements on organisations to have a complaints process specifically for data protection related issues. Once the provision comes into force, we would expect that more complaints will be resolved by organisations without the involvement of the ICO.

If people do bring their complaint to the ICO, we want to provide the most effective service given the finite resources we have. That means looking at our own approach to handling complaints.

We are proposing changes to our processes to better support people who have experienced harm and focus our resources on those cases where we can have the biggest impact. Organisations will also benefit from reduced routine engagement on lower-risk cases, enabling them to focus on the most significant concerns. Our goal is not just to manage demand, but to raise standards around customer experience and regulatory effectiveness.

We have developed a draft framework that we propose to use to determine the extent to which it is appropriate to investigate each complaint. We are also proposing new reporting mechanisms to enable us to monitor complaint volumes across specific organisations and sectors. This will allow us to identify trends or themes which may benefit from other types of regulatory action.

The approach outlined in this consultation would ensure that every complaint contributes towards our understanding of an organisation’s information rights practices, while allowing us to focus our resources on the most significant risks. It also strengthens our ability to identify systemic issues earlier.

It reflects our ambition to be a strategic regulator – one that considers every complaint, responds proportionately and uses the insight gained to drive improvements in data protection practices.

We need to do things differently and transforming our processes will enable us to target our resources to support people’s information rights in a way that has a positive impact and addresses the areas that cause the greatest harm.

Please respond to the ideas in our consultation to help shape the process. 

The questions are split into the following sections:

Section 1: About you.

Section 2: Your views on our approach.

Section 3: Questions to assess the impact of our proposed approach.  

Section 4: Any additional comments about the framework.

The consultation will remain open until 23:59 on Friday 31 October 2025. We may not consider responses received after this deadline.

The PDF document below includes a list of the survey questions.

Privacy Notice

For more information about what we do with personal information at the ICO please see our privacy notice here.

Please note that we are using the platform Citizen Space to gather this information. Citizen Space is provided by Delib. Please see their Privacy Notice for further details.

Responding to our consultation requests and surveys

For this consultation we may publish in full the responses received from organisations or a summary of the responses. If we do publish any responses, we will remove any personal information, email addresses and telephone numbers from these responses. Please do not to share any information in your response which you would not be happy for us to make publicly available.

Should we receive an FOI request for your response we will always seek to consult with you for your views on the disclosure of this information before any decision is made. For more information about what we do with personal data please see our privacy notice and the section on responding to our surveys.