Individuals in the United Kingdom will soon have a new legal avenue to address concerns over the handling of their personal data, as the UK Data (Use and Access) Act 2025 introduces a ‘right to complain’ effective June 19, 2026. This update means that individuals who believe their employer has breached UK data privacy laws regarding their personal information can submit complaints directly to their employer.
Employers are required by the new regulation to provide a complaints form that may be completed electronically or otherwise. For any complaint received on or after June 19, 2026, employers must acknowledge receipt within 30 days and take appropriate steps without undue delay—such as conducting enquiries and informing the complainant of progress. Employers must also communicate the outcome of each complaint back to the individual who raised it.
There is potential for future regulations requiring employers to report complaint numbers to the Information Commissioner’s Office (ICO), which is soon set to become known as the Information Commission. However, specific details about this reporting process—including timing and calculation methods—have not yet been confirmed. In its current guidance, the ICO recommends that employers track all complaints in order to identify trends and areas for improvement.
To prepare for these changes, employers are advised to update privacy notices reflecting individuals’ right to complain from June 19, 2026; develop clear policies and procedures for managing data protection complaints; ensure record keeping systems are current; and train staff on recognising and handling such complaints. The ICO has published guidance intended to help organisations manage this process effectively.
While many employers already respond regularly to employee concerns about personal data processing, these requirements formalise existing practices. The introduction of a formalised right may result in a modest increase in complaint volume but is not expected by observers at Littler Mendelson P.C. to have significant ongoing practical impact.
