New ICO Rules on Data Protection Complaints: Are You Ready?

The clock is ticking. From late 2025, it will be a legal requirement for all organisations to have a documented process in place for handling data protection complaints. The UK Information Commissioner’s Office (ICO) new guidance makes it clear: this isn’t optional, and failure to comply could expose your business to regulatory scrutiny, reputational damage, and even enforcement action.

If your organisation doesn’t yet have a clear, consistent, and accessible complaints procedure, now is the time to act. The good news is that Hoth Complaints software can digitise, streamline, and future-proof your process—making compliance simple, transparent, and efficient.

Why Handling Complaints Matters

Complaints can come from anyone unhappy with how their personal data is handled—whether related to subject access requests, data breaches, or retention periods.

Managing such complaints well:

• Meets legal obligations

• Prevents escalation to regulators

• Enhances customer confidence

• Offers insights to improve processes

What You Must Do 

The ICO emphasises mandatory actions that are legally binding:

• Establish a complaints process and prominently publish it on your website or communicate it early in interactions.

• Acknowledgement within 30 days of receipt—whether via email, mail, or another form—with a record kept.

• Timely, thorough response to complaints—investigate “without undue delay” and keep complainants updated.

• Record outcomes clearly, outlining what action was taken and why, and provide these details to the complainant.

What You Should Do

(Best Practice)

While not legally required, these practices encourage clarity and trust:

• Use plain language, avoiding legalese, so your procedure is easily understood.

• When a complaint is made by a third party on behalf of someone else, verify their authority—e.g., power of attorney or signed permission—and if not authorised, explain why you cannot proceed.

• Record keeping: track dates, communications, documents, decisions, and retention timelines—both for transparency and future proofing.

What You Could Do (Going Further)

These additional steps can elevate your complaint handling:

• Offer versatile complaint channels: online forms, phone, live chat, and in-person options.

• Proactively mention in your privacy notice how complaints are handled —adding visibility and accessibility.

• Train your staff to recognise and escalate data protection complaints appropriately.

What to Do If the ICO Updates Guidance

The ICO’s guidance is currently in draft, with consultation open until 19 October 2025. But the underlying legal requirement is set. Under the Data (Use and Access) Act 2025, every organisation must have:

• A clear complaints procedure

• 30-day acknowledgement

• Prompt investigations and updates

• Transparent records of outcomes

Quick Action Checklist