Data protection complaints: the duty that started on 19 June 2026, and a simple way to log, acknowledge and answer them

By Jason Sibley

What this is for, and who it's for

If you hold personal information about other people, this applies to you. That includes customer lists, client files, booking notes and staff records, so it covers nearly every small business and sole trader.

Since 19 June 2026 you've had to give people a clear way to complain about how you've handled their data and deal with those complaints properly. This guide explains what that means and gives you a process you can put in place in an afternoon.

This is general information, not legal advice. The Information Commissioner's Office (ICO) is the regulator. Check its small organisations pages for the detail. If a complaint is serious or looks likely to lead to a claim, speak to a solicitor.

What changed on 19 June 2026

The ICO says that from 19 June 2026 all organisations are legally required to handle data protection complaints under the Data (Use and Access) Act 2025. Its [news item from May 2026](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/05/one-month-to-go-what-bus