{"id":42197,"date":"2026-06-19T00:01:38","date_gmt":"2026-06-18T23:01:38","guid":{"rendered":"https:\/\/www.thebusinessdesk.com\/south-west\/news\/42197-are-you-ready-for-the-new-data-protection-complaints-law"},"modified":"2026-06-19T00:01:38","modified_gmt":"2026-06-18T23:01:38","slug":"are-you-ready-for-the-new-data-protection-complaints-law","status":"publish","type":"post","link":"https:\/\/www.thebusinessdesk.com\/south-west\/news\/42197-are-you-ready-for-the-new-data-protection-complaints-law","title":{"rendered":"Are you ready for the new data protection complaints law?"},"content":{"rendered":"

New legal requirements for UK companies on handling data protection complaints come into force today, 19 June.<\/p>\n

All organisations are now required under the Data (Use and Access) Act 2025 to give people a clear and accessible way to raise a data protection complaint, acknowledge it within 30 days, investigate and respond appropriately, and explain the outcome.<\/p>\n

Data regulator the Information Commissioner\u2019s Office (ICO) explained that the types of data protection complaints businesses most commonly receive include: subject access requests, where individuals ask to see the personal data an organisation holds about them; incorrect or outdated personal records; marketing preferences and unwanted contact; and minor data security concerns.<\/p>\n

Much of this will already be covered by existing GDPR policies, with the new law focused on handling complaints consistently, transparently and in a timely manner, according to Emily Keaney, deputy commissioner for regulatory policy at the ICO.<\/p>\n

“You should have a clear point of contact for complaints, acknowledge them on time, know who is responsible for investigating them and make sure people get a clear explanation of the outcome.<\/p>\n

“Done well, a straightforward complaints process helps resolve issues quickly, protects customer trust and prevents small problems from becoming bigger ones.”<\/p>\n

The ICO noted that sectors where complaints are most common include healthcare, finance, technology and retail.<\/p>\n

Gareth Perry, managing director of Databroker, suggested that Scottish businesses should treat this as an operational deadline; not just a legal update.<\/p>\n

“The largest risk is that complaints fall between teams: a customer might raise an issue through a website form, inbox, call centre, sales contact, or social media message, but if nobody knows who owns it, the clock is already ticking.<\/p>\n

“The consequences of getting this wrong are not just regulatory, a poorly handled complaint can quickly become an ICO escalation, a reputational problem, or evidence that the organisation does not understand its own data processes.<\/p>\n

“For smaller Scottish firms, the practical procedure is to create one visible complaints route, train staff to recognise data protection complaints and keep a simple audit trail showing when the complaint was received, acknowledged, investigated and answered,” he added. “The less obvious point is that this may expose weak data housekeeping, as if a business cannot explain where someone\u2019s data came from, why it is being used, or who has access to it, the complaints process will reveal that very quickly.”<\/p>\n

\"Howden\u2019s

Howden\u2019s risk advisory lead, Grant Foster<\/strong><\/p><\/div>\n

Grant Foster, partner and risk advisory leader at Howden, said that UK organisations now face two non-negotiable shifts in data protection requirements: a mandatory, formalised complaints process for all data controllers, and significantly higher expectations around transparency when artificial intelligence (AI) is used to process personal data.<\/p>\n

“These changes mark a decisive move by regulators to put accountability and clarity at the centre of data governance, with no exemptions by size or sector and a clear expectation that organisations handle concerns directly before they reach the ICO,” he stated.<\/p>\n

“At the same time, organisations must ensure their privacy notices plainly explain how and why AI is used, what data it touches, and how individuals can challenge or seek human review of decisions that affect them – for many, particularly across financial and professional services, this will require urgent review and updating of existing processes and disclosures, as regulators signal that vague or outdated approaches will no longer meet legal standards.”<\/p>\n

The first requires every data controller to have a formal process for handling data protection complaints. The second raises the bar on how clearly you tell people when AI is involved in processing their information.<\/p>\n

If AI is being used to process personal data and a company’s privacy notice does not say so clearly, it risks breaching transparency and accountability obligations under GDPR articles 5(1)(a), 12 to 15 and 22.<\/p>\n

“The standard expected is not a vague line buried in your terms and conditions,” pointed out Foster. “Your privacy notice needs to explain, in plain English, where AI is used and why, what personal data it touches, whether that data is shared with third-party AI platforms and whether it is used to train or improve AI systems.<\/p>\n

“It also needs to cover how AI influences decisions that affect individuals and what someone can do if they want a human to review an outcome.”<\/p>\n

That last point matters particularly in pensions, insurance and risk advisory. Where AI supports assessments or decisions that have a real impact on clients or scheme members, people have the right to object, request a human review and challenge the result.<\/p>\n

The Financial Conduct Authority’s Consumer Duty requires firms to deliver good outcomes for their retail customers, act in good faith and support customers in making informed decisions. Being open and honest about how personal data is used, including where AI is involved, sits within those expectations.<\/p>\n

“Getting your privacy notices and complaints process right is not just about GDPR compliance,” added Foster. “It is also evidence you can point to when demonstrating to the FCA that you are being open and honest with your clients about what you do with their data.<\/p>\n

“The FCA has significant enforcement powers and uses them: framing data protection improvements as part of your broader Consumer Duty programme is a sensible way to make the case internally and to your regulator.”<\/p>\n

\"Jee-Young

Jee-Young Song, a senior solicitor specialising in pensions at Burness Paull<\/strong><\/p><\/div>\n

Jee-Young Song, a senior solicitor specialising in pensions at Burness Paull, said that while the new rules do not fundamentally change the role of trustees as data controllers, they do raise the bar in how that role must be performed.<\/p>\n

The Data Use and Access Act introduces a new lawful basis for processing personal data: Recognised Legitimate Interests (RLIs). This means trustees can act proactively on certain specified lawful bases, without needing to carry out a benefit\/impact balancing exercise, but also means internal policies and privacy notices must be updated to reflect this.<\/p>\n

“Trustees should instead clearly identify which RLIs are relevant to their scheme and policy documentation – including in any privacy notices shared with scheme members – most commonly those relating to prevention of crime or safeguarding vulnerable individuals; though it is worth bearing in mind that RLIs do not apply to processing of special category personal data,” she noted.<\/p>\n

The act also creates a framework that removes some of the prior restrictions on the use of automated decision making (ADM) and allows pension schemes to expand its in administration. While this streamlines processes, it also presents a risk for trustees if requirements are not met.<\/p>\n

“Where trustees are not satisfied with data quality or data management, they will need to ensure that processes are put in place to improve them, prior to any ADM being implemented, as this will affect the quality of decision outcomes,” added Song. “Trustees may wish to consider suggesting targeted training for scheme administrators in relation to the operation of ADM procedures, to ensure that such procedures are applied effectively in practice.”<\/p>\n

Richard Bradley, data protection team manager at WorkNest Secure, pointed out that there is a new Article 6 lawful basis called ‘recognised legitimate interests’ which is essentially a whitelist of allowable uses for data without requiring the completion of a legitimate interests assessment.<\/p>\n

“This will mean that organisations will need to review their Records of Processing Activities and privacy notices to ensure that the most appropriate lawful basis has been selected for their activities,” he explained. “In the long run, this will simplify the process when assessing the use of data for purposes such as safeguarding and crime reporting or investigation.”<\/p>\n

There is also an enhancement to the right to be forgotten: a change to safeguard people who have been subject to vexatious allegations by a stalker.<\/p>\n

“In such cases, the right becomes near absolute and the person subjected to those allegations, when said allegations were found unsubstantiated and to have been maliciously made by a person convicted of stalking or subject to a stalking protection order,” Bradley concluded.<\/p>\n","protected":false},"excerpt":{"rendered":"

Today’s regulatory update focuses on companies handling complaints consistently, transparently and in time<\/p>\n","protected":false},"author":278857,"featured_media":42199,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[137137,58124,50204],"coauthors":[137126],"class_list":["post-42197","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-analysis","category-professionals","category-technology","tag-featured-story","tag-national","tag-scotland"],"yoast_head":"\nAre you ready for the new data protection complaints law? - South West<\/title>\n<meta name=\"description\" content=\"Today's regulatory update focuses on companies handling complaints consistently, transparently and in time.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.thebusinessdesk.com\/south-west\/news\/42197-are-you-ready-for-the-new-data-protection-complaints-law\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Are you ready for the new data protection complaints law? - South West\" \/>\n<meta property=\"og:description\" content=\"Today's regulatory update focuses on companies handling complaints consistently, transparently and in time.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.thebusinessdesk.com\/south-west\/news\/42197-are-you-ready-for-the-new-data-protection-complaints-law\" \/>\n<meta property=\"og:site_name\" content=\"South West\" \/>\n<meta property=\"article:published_time\" content=\"2026-06-18T23:01:38+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.thebusinessdesk.com\/_files\/images\/2026\/06\/Screenshot-2026-06-15-115244-e1781520812280.png\" \/>\n\t<meta property=\"og:image:width\" content=\"660\" \/>\n\t<meta property=\"og:image:height\" content=\"440\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Peter Walker\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Peter Walker\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.thebusinessdesk.com\/south-west\/news\/42197-are-you-ready-for-the-new-data-protection-complaints-law\",\"url\":\"https:\/\/www.thebusinessdesk.com\/south-west\/news\/42197-are-you-ready-for-the-new-data-protection-complaints-law\",\"name\":\"Are you ready for the new data protection complaints law? - South West\",\"isPartOf\":{\"@id\":\"https:\/\/www.thebusinessdesk.com\/south-west\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.thebusinessdesk.com\/south-west\/news\/42197-are-you-ready-for-the-new-data-protection-complaints-law#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.thebusinessdesk.com\/south-west\/news\/42197-are-you-ready-for-the-new-data-protection-complaints-law#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.thebusinessdesk.com\/_files\/images\/2026\/06\/Screenshot-2026-06-15-115244-e1781520812280.png\",\"datePublished\":\"2026-06-18T23:01:38+00:00\",\"dateModified\":\"2026-06-18T23:01:38+00:00\",\"author\":{\"@id\":\"https:\/\/www.thebusinessdesk.com\/south-west\/#\/schema\/person\/109b99e36bee505d2edeccc48643f581\"},\"description\":\"Today's regulatory update focuses on companies handling complaints consistently, transparently and in time.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.thebusinessdesk.com\/south-west\/news\/42197-are-you-ready-for-the-new-data-protection-complaints-law#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.thebusinessdesk.com\/south-west\/news\/42197-are-you-ready-for-the-new-data-protection-complaints-law\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.thebusinessdesk.com\/south-west\/news\/42197-are-you-ready-for-the-new-data-protection-complaints-law#primaryimage\",\"url\":\"https:\/\/www.thebusinessdesk.com\/_files\/images\/2026\/06\/Screenshot-2026-06-15-115244-e1781520812280.png\",\"contentUrl\":\"https:\/\/www.thebusinessdesk.com\/_files\/images\/2026\/06\/Screenshot-2026-06-15-115244-e1781520812280.png\",\"width\":660,\"height\":440,\"caption\":\"Proper data protection is crucial for customer-facing businesses\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.thebusinessdesk.com\/south-west\/news\/42197-are-you-ready-for-the-new-data-protection-complaints-law#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.thebusinessdesk.com\/south-west\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Are you ready for the new data protection complaints law?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.thebusinessdesk.com\/south-west\/#website\",\"url\":\"https:\/\/www.thebusinessdesk.com\/south-west\/\",\"name\":\"South West\",\"description\":\"Regional business news for South West\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.thebusinessdesk.com\/south-west\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.thebusinessdesk.com\/south-west\/#\/schema\/person\/109b99e36bee505d2edeccc48643f581\",\"name\":\"Peter Walker\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.thebusinessdesk.com\/south-west\/#\/schema\/person\/image\/c57620367d28cdb0f30e67565edd245b\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/98d464629712dffbba0109d76e7f73f2?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/98d464629712dffbba0109d76e7f73f2?s=96&d=mm&r=g\",\"caption\":\"Peter Walker\"},\"url\":\"https:\/\/www.thebusinessdesk.com\/south-west\/news\/author\/peter.walkerthebusinessdesk.com\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Are you ready for the new data protection complaints law? - South West","description":"Today's regulatory update focuses on companies handling complaints consistently, transparently and in time.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.thebusinessdesk.com\/south-west\/news\/42197-are-you-ready-for-the-new-data-protection-complaints-law","og_locale":"en_GB","og_type":"article","og_title":"Are you ready for the new data protection complaints law? - South West","og_description":"Today's regulatory update focuses on companies handling complaints consistently, transparently and in time.","og_url":"https:\/\/www.thebusinessdesk.com\/south-west\/news\/42197-are-you-ready-for-the-new-data-protection-complaints-law","og_site_name":"South West","article_published_time":"2026-06-18T23:01:38+00:00","og_image":[{"width":660,"height":440,"url":"https:\/\/www.thebusinessdesk.com\/_files\/images\/2026\/06\/Screenshot-2026-06-15-115244-e1781520812280.png","type":"image\/png"}],"author":"Peter Walker","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Peter Walker","Estimated reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.thebusinessdesk.com\/south-west\/news\/42197-are-you-ready-for-the-new-data-protection-complaints-law","url":"https:\/\/www.thebusinessdesk.com\/south-west\/news\/42197-are-you-ready-for-the-new-data-protection-complaints-law","name":"Are you ready for the new data protection complaints law? - South West","isPartOf":{"@id":"https:\/\/www.thebusinessdesk.com\/south-west\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.thebusinessdesk.com\/south-west\/news\/42197-are-you-ready-for-the-new-data-protection-complaints-law#primaryimage"},"image":{"@id":"https:\/\/www.thebusinessdesk.com\/south-west\/news\/42197-are-you-ready-for-the-new-data-protection-complaints-law#primaryimage"},"thumbnailUrl":"https:\/\/www.thebusinessdesk.com\/_files\/images\/2026\/06\/Screenshot-2026-06-15-115244-e1781520812280.png","datePublished":"2026-06-18T23:01:38+00:00","dateModified":"2026-06-18T23:01:38+00:00","author":{"@id":"https:\/\/www.thebusinessdesk.com\/south-west\/#\/schema\/person\/109b99e36bee505d2edeccc48643f581"},"description":"Today's regulatory update focuses on companies handling complaints consistently, transparently and in time.","breadcrumb":{"@id":"https:\/\/www.thebusinessdesk.com\/south-west\/news\/42197-are-you-ready-for-the-new-data-protection-complaints-law#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.thebusinessdesk.com\/south-west\/news\/42197-are-you-ready-for-the-new-data-protection-complaints-law"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.thebusinessdesk.com\/south-west\/news\/42197-are-you-ready-for-the-new-data-protection-complaints-law#primaryimage","url":"https:\/\/www.thebusinessdesk.com\/_files\/images\/2026\/06\/Screenshot-2026-06-15-115244-e1781520812280.png","contentUrl":"https:\/\/www.thebusinessdesk.com\/_files\/images\/2026\/06\/Screenshot-2026-06-15-115244-e1781520812280.png","width":660,"height":440,"caption":"Proper data protection is crucial for customer-facing businesses"},{"@type":"BreadcrumbList","@id":"https:\/\/www.thebusinessdesk.com\/south-west\/news\/42197-are-you-ready-for-the-new-data-protection-complaints-law#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.thebusinessdesk.com\/south-west\/"},{"@type":"ListItem","position":2,"name":"Are you ready for the new data protection complaints law?"}]},{"@type":"WebSite","@id":"https:\/\/www.thebusinessdesk.com\/south-west\/#website","url":"https:\/\/www.thebusinessdesk.com\/south-west\/","name":"South West","description":"Regional business news for South West","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.thebusinessdesk.com\/south-west\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Person","@id":"https:\/\/www.thebusinessdesk.com\/south-west\/#\/schema\/person\/109b99e36bee505d2edeccc48643f581","name":"Peter Walker","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.thebusinessdesk.com\/south-west\/#\/schema\/person\/image\/c57620367d28cdb0f30e67565edd245b","url":"https:\/\/secure.gravatar.com\/avatar\/98d464629712dffbba0109d76e7f73f2?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/98d464629712dffbba0109d76e7f73f2?s=96&d=mm&r=g","caption":"Peter Walker"},"url":"https:\/\/www.thebusinessdesk.com\/south-west\/news\/author\/peter.walkerthebusinessdesk.com"}]}},"_links":{"self":[{"href":"https:\/\/www.thebusinessdesk.com\/south-west\/wp-json\/wp\/v2\/posts\/42197","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thebusinessdesk.com\/south-west\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thebusinessdesk.com\/south-west\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thebusinessdesk.com\/south-west\/wp-json\/wp\/v2\/users\/278857"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thebusinessdesk.com\/south-west\/wp-json\/wp\/v2\/comments?post=42197"}],"version-history":[{"count":1,"href":"https:\/\/www.thebusinessdesk.com\/south-west\/wp-json\/wp\/v2\/posts\/42197\/revisions"}],"predecessor-version":[{"id":42201,"href":"https:\/\/www.thebusinessdesk.com\/south-west\/wp-json\/wp\/v2\/posts\/42197\/revisions\/42201"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thebusinessdesk.com\/south-west\/wp-json\/wp\/v2\/media\/42199"}],"wp:attachment":[{"href":"https:\/\/www.thebusinessdesk.com\/south-west\/wp-json\/wp\/v2\/media?parent=42197"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thebusinessdesk.com\/south-west\/wp-json\/wp\/v2\/categories?post=42197"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.thebusinessdesk.com\/south-west\/wp-json\/wp\/v2\/coauthors?post=42197"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}