Data Protection Complaints Procedure

A new requirement for employers

There is a huge increase in the number of data subject access requests (DSARs) that we are seeing.

Employees are more aware of their rights, and they are being used in workplace disputes as a mechanism to obtain as much information as possible to feed into a grievance or tribunal claim.

From the 19th of June 2026, however, there is a key legal change which employers must be aware of.

New provisions under the Data (Use and Access) Act 2025 now require employers to have a formal data protection complaints procedure in place to allow employees to raise a complaint directly with their employer about how their personal data has been handled, including how a DSAR has been dealt with.

Where a complaint is received, employers must:

• Acknowledge complaints within 30 days of receipt
• Carry out a reasonable investigation into the complaint
• Take appropriate steps to respond without undue delay
• Inform the complainant of the outcome without undue delay
• Keep records of complaints and outcomes

Importantly, this does not replace complaints to the Information Commissioner’s Office (ICO); if employees are not satisfied with their employer’s response, they can still escalate the issue to the ICO.

Employers must now:

1. Put a data protection complaints procedure in place setting out how employees can raise concerns and how those concerns will be handled.
2. Update privacy notices to signpost employees to the internal complaints procedure.
3. Train anyone responsible for handling DSARs to ensure they can identify a data protection complaint.

We have prepared a data protection complaints procedure and updated privacy notice that can be adapted for your business.

If you’re not sure your complaints procedure meets the new requirement, contact Solutions for HR today.