Data Use and Access Act 2025 Grants New Complaint Rights

The Data Use and Access Act 2025 gives individuals new rights to complain directly to data controllers.

The Data Use and Access Act 2025 introduces a new statutory right for individuals to complain directly to data controllers about their personal data handling. Having received Royal Assent in June 2025, the Act’s provisions become effective one year later, requiring preparedness from affected organizations. Under the Act, data controllers must acknowledge receipt of any complaint within 30 days and initiate investigations without undue delay. This formalizes the complaint process and demands that legal and compliance teams establish clear internal procedures to respond efficiently. The Information Commissioner's Office (ICO) supports this approach with detailed guidance on managing data protection complaints. Their recommendations include utilizing multiple communication channels—such as social media—to receive complaints, which broadens accessibility for complainants. Crucially, before escalating concerns to the ICO, individuals must lodge their complaints directly with the data controllers. This shifts early resolution responsibilities onto organizations, impacting legal operations and privacy risk management. As the effective date approaches, organizations should audit and update complaint-handling policies and training. Timely action is necessary to mitigate the risk of non-compliance and protect organizational reputation in the evolving data protection environment.

What's next: Organizations should review complaint-handling procedures and train relevant staff before the mid-2026 enforcement date to ensure compliance.