UK law gives you 30 days to acknowledge a data protection complaint

A user writes to your support inbox: "I deleted my account in March, and today I got a password reset email from you. Why do you still have my data?" Since 19 June 2026, if the UK GDPR covers your product (because your company is in the UK, or because you offer the product to people there), that email is a complaint under section 164A of the UK Data Protection Act 2018 1 2 3. The law now requires you to give people a way to complain to you, to acknowledge each complaint within 30 days, to look into it and keep the person informed without undue delay, and to tell them the outcome 2. Your privacy policy also has to say that people can complain to you, next to the line that already names the regulator. A company that ignores the rule can get an enforcement notice and a fine.

The user can still take the problem to the UK regulator, the ICO 13, although the ICO asks most people to raise it with the company first 9. What changed in June is that the company now has duties of its own as soon as the complaint arrives.

What does the new UK complaints rule require?

The rule gives a person a right to complain to the company that decides how their data is used (in law, the "controller") if they think it broke the UK GDPR. It puts four duties on that company 2:

1. Give people a way to complain. The law's own example is "a complaint form which can be completed electronically and by other means" 2.
2. Acknowledge each complaint within 30 days of receiving it 2.
3. Look into it without undue delay, which includes making enquiries and telling the person how it is going 2.
4. Tell the person the outcome, also without undue delay 2.

The ICO's guidance says the 30 days count from the day after the complaint arrives, weekends and holidays included. If day 30 falls on a weekend or a public holiday, you have until the next working day 4.

The 30 days only cover the acknowledgement. The ICO expects you to start looking into the complaint on the day it arrives, and to be able to justify how you handled each one 4.

Does the rule apply if my company is outside the UK?

Yes, if the UK GDPR applies to what you do with that person's data. The UK GDPR covers a company established in the UK, and also a company outside the UK that offers goods or services to people in the UK or monitors their behaviour there 5. The Data Protection Act, where the complaints rule sits, applies to the same processing 6. So a SaaS company in Copenhagen or Berlin that offers its product to people in the UK owes them the same complaints process as a company in London. There is no exemption for size 2.

If you sell to other businesses, it matters whose data the complaint is about. For your own customers' account and billing details, you decide how the data is used, so the duty is yours. For data you hold on a customer's behalf, such as the records in their workspace, your customer decides, so the duty stays with them. The ICO says you should pass such complaints on to the customer and help with the investigation 8. It does not say whether the 30 days start when you receive the complaint or when your customer does, so I would pass it on the same day.

What counts as a data protection complaint?

A data protection complaint is any message where someone says you broke data protection law in how you handled their personal data 7. The person does not have to use the word "complaint", and they "don't have to use legal terms or quote sections of the legislation" 7. The ICO's examples include complaints about:

• how you answered an access request or another rights request,
• your security, including after a breach,
• how you collect, use, store or keep personal data, or how accurate it is 7.

A rights request is not in itself a complaint. "Please delete my account" is a request, with its own one-month deadline (Ulf covered that deadline in the post on the CNIL's fine for unanswered deletion requests). "I asked you to delete my account and you still have my data" is a complaint about how you handled that request. If you cannot tell which one you have, the ICO says to ask the person 7. The password reset email in the opening is a complaint, and it is also evidence that a deletion did not work, so the investigation is into your deletion process.

My advice is to make the call generous. If a message says you mishandled someone's data, in any words, treat it as a complaint and acknowledge it. An acknowledgement you did not need costs one email. A complaint you missed has no record when the regulator asks for one.

The complaint can arrive anywhere. "However you receive a complaint, you must accept it," says the ICO 8.

What happens if you ignore a complaint?

If 30 days pass without an acknowledgement, you have already broken the rule, and the person can take the complaint to the ICO 13. The ICO's complaint page asks them for a copy of the complaint they sent you.

The ICO says you should keep a record of the date you received each complaint, your acknowledgement, any relevant conversations and documents, the outcome, and any actions you took, and that it may ask to see that record if a complaint is made about you 4. Without the record, you cannot show that you met the four duties.

The ICO can then issue an enforcement notice, which is a legal order to fix the failure 10, and a fine of up to £8.7 million or 2% of worldwide annual turnover, whichever is higher 11.

What has to change in your privacy policy?

Most privacy policies written before June 2026 have one sentence that says "you can complain to the ICO". That sentence is still required. (The regulator became the Information Commission on 30 September 2026 and keeps the name "the ICO".) Since 19 June 2026, the list of what a privacy policy must say also includes "the right to make a complaint to the controller", meaning you 12 10. The ICO says you must tell people "they can complain to you, as well as to us", at the point you collect their data 8. For example:

If you think we have not handled your personal data lawfully, you can complain to us at privacy@example.com. We will acknowledge your complaint within 30 days.

Two of your standard replies need the same line, added to the wording about the regulator and the courts that they already carry: the reply when someone asks for a copy of their data, and the reply when you decline to act on a rights request 10.

The rule says you must "facilitate" complaints, that is, make them easy to make 2. In my reading, a complaints address that bounces, or that nobody reads, does not do that. No UK decision has tested it yet. Under the EU GDPR, the Spanish regulator fined Securitas Direct for a paid phone line it offered for data requests, judging that route on its own merits.

What should you change if your product has users in the UK?

These steps cover the four duties and the notices that changed with them.

• Add the complaint line to your privacy policy. Say people can complain to you, give the address or form, and keep the line about the regulator.
• Update your access request and refusal templates. Add the same line to both 10 8.
• Pick one channel and name it. A dedicated address such as privacy@ is enough. The ICO says you do not need a separate tool if an existing one lets you meet the duties 8.
• Set an automatic acknowledgement on that channel. The ICO says an auto-reply email can be your acknowledgement 4. That covers duty 2 for everything that arrives there.
• Teach support to recognise a complaint in the main inbox. People can complain through any channel, so complaints will also reach your support inbox. Add a tag or macro for "data protection complaint" so the 30 days are tracked from the day after arrival.
• Search the support inbox back to 19 June. Any complaint that never got an acknowledgement was already late. I would acknowledge and answer it now, and start its record.
• Keep a record of each complaint. Note the date received, the acknowledgement, the relevant messages, the outcome, and what you changed 4.
• If you sell to other businesses, add complaints to your data processing agreement. Your customer keeps the duty for the data you hold for them. Agree how you pass their complaints on and how you help them investigate 8.