UK GDPR Complaints Rules Are Changing in June 2026. Is Your Business Ready?

UK GDPR Complaints Rules Are Changing This Month. Here’s What Businesses Need To Know

From 19 June 2026, UK organisations will face a new legal requirement to have a clear process for handling data protection complaints.

For many businesses, this may sound like a small administrative change. In reality, it is much more than that. It changes how organisations need to receive, acknowledge, investigate, document and respond to complaints about the way they use personal data.

It also creates a clear policy update requirement.

Most organisations already have a privacy policy, data protection policy or GDPR statement. Some have a subject access request procedure. Many have a general complaints process. But far fewer have a specific, operational and documented process for handling data protection complaints.

That gap now matters.

The change forms part of the UK’s Data Use and Access Act 2025, often referred to as the DUAA. While many of the wider data protection reforms have already started to come into force, the data protection complaints requirement becomes live on 19 June 2026. From that date, organisations must be able to show that people have a clear route to complain about how their personal information is handled and that those complaints are managed properly.

This is not just a compliance note for legal teams. It affects HR, customer service, operations, information governance, IT, marketing, procurement and any team that handles personal data.

It is also exactly the type of regulatory change that should trigger a policy review.

What is changing under UK GDPR in June 2026?

The key change is that organisations must have a process in place for handling data protection complaints.

A data protection complaint is a complaint from an individual about how an organisation has used, handled, shared, stored, retained, disclosed or otherwise processed their personal information.

This could include concerns about:

Personal data being used without a proper lawful basis.

A privacy notice being unclear or incomplete.

A subject access request being delayed or mishandled.

Personal information being shared with the wrong person.

Data being retained for longer than necessary.

An individual being unhappy with an automated decision.

An employee believing their workplace data has been misused.

A customer objecting to marketing use of their personal data.

A person believing their data rights have not been respected.

From 19 June 2026, organisations will need to give people a clear way to make this kind of complaint. They will also need to acknowledge receipt within 30 days and respond without undue delay.

That means this is no longer something that can sit informally in an inbox, be handled inconsistently by different teams, or be treated as a general customer service issue without proper data protection oversight.

The law is moving towards more visible accountability.

Businesses will need to show not only that they comply with data protection law, but that they have a practical route for individuals to challenge or question how their personal information is being handled.

Why this change matters

The practical impact of this change is bigger than many organisations may realise.

Data protection compliance has often focused on major visible obligations such as privacy notices, cookie banners, data breach reporting, subject access requests and data processing agreements. Complaints handling has often been treated as a secondary issue.

That is changing.

The new requirement creates an expectation that organisations will have an accessible, documented and repeatable process for handling data protection concerns. This means the process needs to exist before a complaint is received, not be created reactively after something goes wrong.

For organisations with limited internal compliance resource, this creates risk.

A complaint may come through a website form, a customer support inbox, a sales contact, an HR manager, a DPO, a generic info@ email address, a call centre, a social media message or a letter. If staff do not recognise it as a data protection complaint, the 30 day acknowledgement requirement could be missed.

This is where policy and process alignment becomes critical.

The issue is not just whether the legal team knows the rule. The issue is whether the business can operationalise it.

Can frontline teams recognise a data protection complaint?

Is there a clear escalation route?

Does the organisation know who owns the response?

Is there a template acknowledgement?

Is there a record of what was received, when it was received and how it was investigated?

Can the organisation evidence the outcome?

Does the privacy policy tell people how to complain?

Does the internal data protection policy explain staff responsibilities?

Does the general complaints policy cross refer to data protection complaints?

If the answer to any of these questions is no, the organisation may need to update its policies and procedures before the new requirement becomes live.

What organisations must do from 19 June 2026

From 19 June 2026, organisations must be ready to handle data protection complaints in a structured way.

At a minimum, businesses should have a clear route for individuals to make a complaint. This could be an online form, a dedicated email address, a postal address, a customer support process or another accessible method. The important point is that individuals should not have to guess how to raise a concern about their personal data.

The organisation must acknowledge receipt of the complaint within 30 days. This does not necessarily mean the complaint must be fully resolved within 30 days, but the individual must receive confirmation that the complaint has been received.

The organisation must then take appropriate steps to investigate and respond without undue delay. That phrase matters. It means businesses cannot simply acknowledge the complaint and then allow it to drift. They need to make enquiries, keep the person informed and provide an outcome.

The outcome should explain what the organisation has found, what action it has taken where appropriate, and what the individual can do next if they remain unhappy.

This is why the requirement should not be treated as a minor privacy notice update. It needs an internal operating model behind it.

Who does this apply to?

The new complaints requirement applies to organisations that act as data controllers.

A data controller is the organisation that decides why and how personal data is processed. In practice, this includes most businesses, charities, public bodies, education providers, healthcare providers, financial services firms, employers and professional services firms.

If your organisation collects employee data, customer data, candidate data, supplier contact data, website user data or marketing data, it is likely to be acting as a controller for at least some of that processing.

This means the change is not limited to technology companies or large enterprises.

It affects SMEs as well as larger organisations.

In fact, smaller organisations may be more exposed because they often rely on informal processes. They may have a privacy policy on their website, but no documented internal workflow for handling data protection complaints. They may assume that any complaint will go to a senior person, but that is not the same as having a compliant process.

The requirement also matters for organisations with multiple sites, departments or jurisdictions. If complaints can enter the business through several channels, the organisation needs consistency. One team should not handle complaints carefully while another team misses the issue entirely.

What counts as a data protection complaint?

A data protection complaint does not need to use legal language.

An individual does not need to say, “I am making a complaint under UK GDPR.”

They might say:

“I want to know why you still have my data.”

“Why have you sent my details to that company?”

“I asked you to delete my information and you have not done it.”

“I do not understand how you are using my personal data.”

“You have sent me marketing emails after I unsubscribed.”

“You have shared my information with the wrong person.”

“My employer has accessed information they should not have accessed.”

“Your privacy policy does not explain this properly.”

“I think your system has made an unfair decision about me.”

Any of these could be a data protection complaint.

This is one of the biggest operational challenges. If staff are only trained to look for formal legal wording, complaints may be missed. A data protection complaint can arrive in plain English, through a normal business channel, from a customer, employee, candidate, supplier or member of the public.

The safest approach is to define the trigger clearly in internal policy.

A complaint should be treated as a data protection complaint where an individual expresses dissatisfaction, concern or objection about the way their personal information has been collected, used, disclosed, stored, retained, deleted or otherwise handled.

Which policies may need updating?

This change is likely to affect several policies and procedures, not just one document.

The most obvious document is the Data Protection Policy. This should explain the organisation’s approach to data protection complaints, the roles and responsibilities involved, and the need to escalate complaints quickly.

The Privacy Policy or Privacy Notice may also need updating. Individuals should be told how they can complain about the use of their personal information. If the current privacy notice only tells people how to contact the organisation for rights requests, it may not go far enough.

The Data Subject Rights Procedure should be reviewed because complaints may overlap with subject access requests, deletion requests, rectification requests, objections and restriction requests. Teams need to understand the difference between a rights request and a complaint, while also recognising that the same communication may contain both.

The Complaints Policy should also be updated. A general complaints policy may not reflect the specific requirements for data protection complaints. Businesses should consider whether the general complaints process needs a dedicated data protection route or escalation point.

Employee Privacy Notices may need to be reviewed where staff, workers or job applicants are likely to raise concerns about the use of their data. HR teams should understand how to identify and escalate employee data protection complaints.

Information Governance Policies may need to be updated to reflect record keeping, investigation and evidence requirements.

Incident Response and Data Breach Procedures may also be affected. A complaint may reveal a data breach, or a data breach may lead to complaints. The two workflows need to connect.

Customer Service Playbooks may need updating because many complaints will first be received by customer support, account management or frontline teams.

Supplier Management Procedures may also be relevant where the complaint concerns personal data handled by a processor, platform, outsourced provider or third party.

This is why a single wording update is not enough.

The change needs to be mapped across the policy estate.

What should a compliant complaints process include?

A strong data protection complaints process should be clear, accessible and evidence based.

It should explain how individuals can make a complaint. This could include a dedicated email address, web form, telephone route or postal address. The route should be easy to find and easy to use.

It should define what counts as a data protection complaint. This helps staff identify complaints even when they are not labelled as such.

It should set out who owns the process internally. In some organisations, this may be the Data Protection Officer. In others, it may be the compliance lead, legal team, information governance function, privacy manager or another named role.

It should explain the acknowledgement requirement. Staff should understand that complaints must be acknowledged within 30 days of receipt.

It should set out investigation steps. This should include reviewing the complaint, confirming the identity of the complainant where needed, gathering relevant records, speaking to relevant teams, checking applicable policies, reviewing systems and deciding whether any corrective action is needed.

It should explain how updates will be provided. Individuals should not be left without communication while an investigation is underway.

It should explain how the outcome will be issued. The outcome should be clear, reasoned and documented.

It should include escalation routes. This may include internal escalation to senior management, legal, the DPO or the board where there is significant risk.

It should link to the ICO escalation route. Individuals should be told what they can do if they remain dissatisfied.

It should include record keeping requirements. The organisation should retain a record of the complaint, acknowledgement, investigation, decision, outcome and any remedial action.

It should include training requirements. Staff need to know how to recognise and escalate complaints.

It should be reviewed regularly. A complaints process is not useful if it becomes outdated or disconnected from actual business operations.

Why this is a policy management issue

For many organisations, the biggest risk is not that they are unaware of the law. The bigger risk is that their policies, procedures and operational workflows do not keep pace with the law.

A regulatory change may be identified by legal or compliance, but if it is not translated into updated policy language, ownership, process steps, training and audit evidence, the business remains exposed.

The June 2026 data protection complaints change is a clear example.

A business may know that complaints must be acknowledged within 30 days, but that knowledge is not enough.

The organisation needs to answer practical questions.

Where is the complaints route published?

Which policy explains it?

Which team owns it?

How are complaints logged?

Who monitors the 30 day acknowledgement requirement?

What happens if the complaint is received by HR?

What happens if it is received by customer support?

What happens if it is sent to a former employee?

What happens if it relates to a processor?

What happens if the complaint reveals a possible data breach?

What evidence is retained?

How does the business prove it complied?

These are not theoretical questions. They are operational compliance questions. They need to be reflected in the organisation’s policy framework.

That is why this change should trigger a policy impact assessment.

The risk of treating this as a website update

Some businesses may respond to the new requirement by adding a line to their privacy policy that says people can email complaints to a generic address.

That may be a start, but it is not enough on its own.

A website update does not ensure complaints are acknowledged within 30 days.

A website update does not train staff to recognise complaints.

A website update does not create investigation records.

A website update does not define internal ownership.

A website update does not ensure HR, legal, IT and customer service teams follow the same process.

A website update does not provide board level evidence that the organisation has implemented the change.

The real question is not, “Have we mentioned complaints in our privacy policy?”

The better question is, “Can we demonstrate that we have an operational process for receiving, acknowledging, investigating, responding to and recording data protection complaints?”

That is the standard organisations should be aiming for.

How this affects HR teams

HR teams hold some of the most sensitive personal data in any organisation.

Employee records, absence data, performance information, disciplinary records, payroll information, occupational health data, recruitment data, right to work documents and diversity monitoring data all create data protection risk.

Employees and candidates may raise concerns about how their data has been handled. These concerns may be framed as HR issues rather than data protection complaints.

For example, an employee may complain that their manager accessed information they should not have seen. A candidate may complain that recruitment data has been retained too long. A former employee may object to the use of their information in a reference process. A worker may challenge how monitoring tools are being used.

HR teams need to know when these concerns should be treated as data protection complaints.

This means employee privacy notices, HR data protection procedures and internal escalation routes should be reviewed.

How this affects customer service and frontline teams

Customer facing teams are likely to receive many of these complaints first.

A customer might complain through live chat, email, telephone, social media or an account manager. The complaint may be mixed with a service issue. For example, a customer may complain about poor service and also say that their personal data has been shared incorrectly.

If frontline teams do not identify the data protection element, the organisation may fail to trigger the right process.

This is why training and clear internal guidance are essential.

Customer service teams do not need to become legal experts. But they do need to recognise the warning signs and know where to escalate.

A simple internal decision tree can make a major difference.

If a complaint mentions personal data, privacy, consent, deletion, access, sharing, marketing, identity, profiling, automated decisions, data breach or misuse of information, it should be escalated for data protection review.

How this affects legal and compliance teams

Legal and compliance teams should treat this change as a governance update.

The business should be able to demonstrate that the new legal requirement has been identified, assessed and implemented.

That means updating relevant policies, documenting the complaints process, setting ownership, creating templates, training relevant staff and maintaining evidence.

Legal and compliance teams should also consider board reporting. Data protection complaints can reveal systemic issues. If complaints show repeated problems with retention, access controls, privacy notices or marketing preferences, the business should identify and address the root cause.

Complaints should not be treated only as individual issues. They are also a source of compliance intelligence.

What should businesses do before 19 June 2026?

Businesses should start with a focused review of their current position.

First, identify whether a data protection complaints process already exists. If it does, check whether it meets the new requirements. If it does not, create one.

Second, review the privacy policy and privacy notices. They should tell individuals how to raise a data protection complaint.

Third, review internal policies. The Data Protection Policy, Complaints Policy, Data Subject Rights Procedure, Employee Privacy Notice and Information Governance Policy may all need updates.

Fourth, create an acknowledgement template. This should confirm receipt of the complaint, explain what will happen next, and provide a clear contact point.

Fifth, create an investigation workflow. This should explain who reviews complaints, what evidence is gathered, how decisions are made and how outcomes are communicated.

Sixth, create a complaints log. This should record the date received, acknowledgement date, complaint summary, owner, actions taken, outcome and closure date.

Seventh, train staff who are likely to receive complaints. This includes HR, customer support, account management, marketing, operations and managers.

Eighth, check processor arrangements. If a complaint relates to data handled by a supplier or processor, the organisation needs a route to obtain information quickly.

Ninth, decide how complaints will be monitored. Regular reporting can help identify trends and recurring risk areas.

Tenth, keep evidence of implementation. This includes updated policies, training records, process documents, logs and approval records.

What should a data protection complaints acknowledgement include?

An acknowledgement should be simple, clear and timely.

It should confirm that the organisation has received the complaint. It should provide the date of receipt. It should explain that the complaint will be reviewed. It should provide a contact point for further information. It should explain whether the organisation needs proof of identity or authority before it can proceed. It should avoid making premature conclusions before the investigation is complete.

A good acknowledgement does not need to be long. But it does need to be documented.

The organisation should retain a copy so that it can evidence compliance with the 30 day acknowledgement requirement.

What should the final outcome include?

The final outcome should explain what the organisation has considered and what it has decided.

Depending on the circumstances, it may include a summary of the complaint, the investigation steps taken, the organisation’s findings, any corrective action, any decision not to take further action, and details of what the individual can do if they remain dissatisfied.

The tone matters.

A defensive or vague response can increase the risk of escalation. A clear, fair and evidence based response can help resolve concerns earlier.

Organisations should also remember that a complaint outcome may later be reviewed by the ICO if the individual escalates the matter. That means the response should be accurate, consistent with the evidence and aligned with the organisation’s policies.

Why audit trails matter

The new complaints requirement increases the importance of audit trails.

If a complaint is escalated, an organisation may need to show when the complaint was received, when it was acknowledged, what steps were taken, who was involved, what evidence was reviewed, what decision was reached and when the individual was informed of the outcome.

Without a proper audit trail, the organisation may struggle to demonstrate compliance.

This is particularly important for businesses where policies are stored across shared drives, inboxes, spreadsheets, outdated PDFs or disconnected systems. If there is no reliable version control or evidence trail, compliance becomes harder to prove.

A modern policy management approach should allow organisations to show what changed, why it changed, who approved it and when it was communicated.

The wider direction of travel

The June 2026 complaints change should be seen as part of a wider regulatory trend.

Regulators increasingly expect organisations to demonstrate active governance, not passive compliance. It is no longer enough to have a policy saved somewhere. The policy must be current, operational, communicated and evidenced.

This is especially true in areas such as data protection, employment law, financial services, cyber security, AI governance, health and safety, safeguarding, whistleblowing and consumer protection.

The direction of travel is clear.

Organisations need to move from static policies to living compliance.

That means detecting legal changes, identifying affected policies, making updates, obtaining approval, deploying changes and retaining the evidence.

The data protection complaints change is a practical example of why this matters.

What policyshift helps organisations do

policyshift helps organisations identify regulatory changes and understand which policies, procedures and controls may need updating.

When a change like the June 2026 data protection complaints requirement comes into force, businesses need more than a legal alert. They need to understand the operational impact.

Which policies are affected?

Which teams need to act?

What wording needs to change?

Who needs to approve the update?

How do we evidence that the update happened?

How do we show staff and stakeholders were informed?

How do we avoid relying on outdated policy documents?

policyshift is designed to support that process by helping organisations move from reactive policy management to continuous compliance confidence.

For a change like this, policyshift can help surface the affected policy areas, support review and approval workflows, maintain a clear audit trail and give teams better visibility over what needs to change.

Key takeaway

From 19 June 2026, organisations must have a clear process for handling data protection complaints.

This is not just a privacy policy update. It is a governance, process, training and evidence issue.

Businesses should review their data protection policies, privacy notices, complaints procedures, HR processes and customer service workflows now.

The organisations that manage this well will not simply comply with the new requirement. They will also build a stronger foundation for trust, accountability and defensible data protection governance.

The organisations that treat it as a minor wording change risk missing the real point.

The rule is changing.

The policy estate needs to change with it.