The ICO has changed how it handles data protection complaints from the public. After consulting in autumn 2025, it published a new complaints framework in February 2026. Since 19 June 2026, organisations have also had a legal duty under the Data (Use and Access) Act 2025 (DUAA) to handle data protection complaints themselves.
This article was first published in October 2025 to cover the ICO’s consultation, which closed on 31 October 2025. It was updated in October 2026 to describe the framework now in use and what it means for organisations.
Why the ICO changed its approach
Data protection complaints to the ICO rose from 39,721 in 2023/24 to 42,881 in 2024/25. The ICO said the volume was affecting its ability to respond quickly, and that its previous approach gave too much time to minor issues and too little to cases showing real harm.
The new framework is intended to focus the ICO’s resources on complaints where it can have the most effect, and to use complaint data to identify problems across organisations and sectors.
How the framework works
The ICO’s published framework sets out the process it follows when someone complains about how an organisation has used their personal information.
Complain to the organisation first
The ICO recommends that people raise their concern with the organisation first and give it a chance to put things right. People can still complain directly to the ICO, but in most cases the ICO will expect the organisation to have had the opportunity to respond.
Triage
The ICO first checks that a complaint is about data protection. It does not deal with complaints that are only about customer service or that belong to another regulator. It then assesses each complaint against published criteria. It is more likely to make further enquiries where:
- the issue has caused, or is likely to cause, a high level of harm
- children or other vulnerable people are significantly affected
- many people are affected
- the issue relates to the ICO’s strategic priorities, or there is a public interest in looking at it
It is less likely to take a complaint further where it already knows about the issue, the organisation is already responding adequately, the organisation appears to have complied with the law, or the problem has been fixed. The ICO’s separate guidance on harm in complaints explains how it assesses harm as low, moderate or high.
Possible outcomes
A complaint may be:
- recorded for information only, with no contact made with the organisation
- closed with a finding that the organisation appears to have complied with the law
- passed to the organisation with a request to do more, such as provide information or correct records
- closed with recommendations to improve the organisation’s policies, procedures or guidance
- considered for regulatory action, which the ICO says it will not take for every complaint
A complainant who disagrees with the outcome can ask for a review, which the ICO aims to complete within 30 calendar days.
The threshold approach
The ICO records every data protection complaint it receives about each organisation, including complaints it does not take further. If the number of complaints about an organisation reaches a set threshold, the ICO carries out a short review of the information it holds. At the time of this update, the threshold is 12 complaints within one month, reviewed quarterly.
Reaching the threshold does not mean the organisation has broken the law. Possible follow-up includes contacting the organisation, giving guidance, monitoring, or referring it for further action. Organisations that reach the threshold are reviewed every six months for at least two years.
The DUAA duty to handle complaints
Since 19 June 2026, every controller must handle complaints from people who think their personal data has been used in breach of data protection law. Organisations must:
- make it easy to complain, for example with a complaint form that can be completed electronically and by other means
- acknowledge each complaint within 30 days
- take appropriate steps to respond without undue delay, including making enquiries
- tell the person how the complaint is progressing and what the outcome is
Our guide to the data protection complaints procedure covers these requirements in more detail.
What this means for your organisation
The two changes work together. The ICO expects people to come to you first, and you are now legally required to deal with their complaint properly. If you do not, the complaint is likely to reach the ICO, where it will be counted towards your threshold and may lead to further enquiries.
Practical steps:
- Check your complaints route is in place. People should be able to find how to complain from your privacy notice and website, and submit a complaint electronically.
- Name an owner. Someone needs to be responsible for logging, investigating and responding to complaints. In a smaller organisation this may be the person who handles data protection.
- Keep a log. Record each complaint, the date it was acknowledged, what was done and the outcome. This helps you meet the 30-day acknowledgement requirement and shows how you handled complaints if the ICO asks.
- Train front-line staff. Customer service, HR and other teams need to recognise a data protection complaint, however it is worded, and know where to send it.
- Look for patterns. Repeated complaints about the same issue usually point to a process that needs fixing, and fixing it reduces the chance of reaching the ICO’s threshold.
Summary
The ICO now triages data protection complaints by harm and impact, expects people to complain to the organisation first, and monitors how many complaints it receives about each organisation. Since 19 June 2026, organisations must have their own process for receiving, acknowledging and resolving those complaints. Handling complaints well internally is now the main way to keep them from becoming an ICO matter.
