Free data protection complaints procedure template
Since 19 June 2026, every UK organisation that handles personal data must deal with data protection complaints itself, and its privacy notice must say so. This template follows the law step by step. Copy it, fill in the parts in square brackets, and publish it.
Last checked against legislation.gov.uk on 14 October 2026. A starting point to adapt, not legal advice.
What the law requires
Section 164A of the Data Protection Act 2018 says that if someone complains to you about how you have handled their personal data, you must:
- Make complaining easy, for example with a complaint form that can be completed online and by other means.
- Acknowledge the complaint within 30 days of receiving it.
- Respond without undue delay: take appropriate steps, including looking into the complaint and telling the person how it is progressing.
- Tell the person the outcome, without undue delay.
Your privacy notice must also tell people they have the right to complain to you (UK GDPR Article 13(2)(ca)). There is no exemption for small organisations or sole traders.
Sources: Data Protection Act 2018, section 164A; UK GDPR Article 13; commencement in SI 2026/82.
The template
Data protection complaints procedure
[Organisation name] ("we") takes the protection of your personal information seriously. If you think we have not handled your personal information properly, you have the right to complain to us. This procedure explains how.
1. How to complain
You can complain in any way that suits you:
- by email to [privacy@yourdomain]
- using our online complaint form at [link]
- by post to [address]
- by phone on [number]
Please tell us your name, how to contact you, what happened, and what you would like us to do. If you need help making a complaint, or need it in a different format, tell us and we will help. We accept a complaint however it reaches us.
2. What happens next
- We will acknowledge your complaint within 30 days of receiving it, and usually much sooner.
- [Name or role] will look into it. We may ask you for more information.
- We will keep you told of progress.
- We will tell you the outcome, and what we have done about it, without undue delay. [We aim to do this within [number] days. Optional: a target you set yourself; the law says "without undue delay".]
3. If you are not satisfied
You can also complain to the UK data protection regulator, the Information Commission (formerly the Information Commissioner's Office). [Add its current website.] We would rather you came to us first so we can try to put things right, but you can go to the regulator at any time.
4. Records
We keep a record of each complaint, what we did and the outcome, for [period]. We use it only to handle complaints and improve how we look after personal information.
Last reviewed: [date]
Add this line to your privacy notice
If you are unhappy with how we have handled your personal information, you have the right to complain to us. See our data protection complaints procedure at [link], or email [privacy@yourdomain]. We will acknowledge your complaint within 30 days.
Is your privacy policy missing anything else?
Any privacy policy last updated before 19 June 2026 cannot include the right to complain, because it did not exist yet. Check your whole policy against current UK law in a few minutes, free.
Questions
When did the data protection complaints procedure become a legal requirement?
19 June 2026, when section 164A of the Data Protection Act 2018 came into force. It was added by the Data (Use and Access) Act 2025.
How quickly must I respond to a data protection complaint?
You must acknowledge it within 30 days of receiving it. You must then respond, and tell the person the outcome, without undue delay. The law does not set a fixed deadline for the outcome.
Do I need an online complaint form?
The law gives "a complaint form which can be completed electronically and by other means" as an example of how to make complaining easy. An email address, a form and a postal route together are a sensible way to meet it. Accept complaints however they arrive.
Is this the same as complaining to the ICO?
No. This is your own process for complaints made to you. People can still complain to the regulator, which was the Information Commissioner's Office (ICO) until 30 September 2026 and is now the Information Commission. Your privacy notice must tell them they can do both.