All charities must have a process in place for handing data protection complaints by Tuesday 19 June 2026.
These are new requirements set out in the Data (Use and Access) Act which states that you must have a process for these complaints in your organisation - there are exemptions to this.
What are data protection complaints?
If someone considers that you've infringed data protection legislation because of the way you've handled their personal information (or the personal information of someone they're acting on behalf of), they can complain to you.
For example, people may submit complaints about:
- the way you’ve responded to their subject access request (SAR), or other rights request
- the security measures you’ve used to store their information (e.g. someone who has been impacted by a data breach)
- how you’ve collected or used their personal information (e.g. where you’ve stored it, how long you’ve kept it for, or its accuracy).
Sometimes people may complain about your service or other matters, whilst also exercising their data protection rights. This doesn’t count as a data protection complaint. For example:
- an employee may raise a grievance issue, and also request copies of their personal information
- a person may complain about a customer service issue, and also request that you delete their information
What data protection law says
You must:
- give people a way of making data protection complaints to you
- acknowledge receipt of complaints within 30 days of receiving them
- without undue delay, take appropriate steps to respond to complaints, including making appropriate enquiries, and keep people informed
- without undue delay, tell people the outcome of their complaints
ICO Guidelines
The Information Commissioner's Office (ICO) have published guidelines to getting a data protection complaints process in place. You can read this here.
