Updates

UK Introduces New Data Protection Complaint Requirements for Employers

Download Publication as a PDF

Key Takeaways

  • As of June 19, organizations subject to UK data protection law, including the UK GDPR, must provide individuals with an accessible method for submitting data protection complaints directly to the organization.
  • Employers should update workforce privacy notices and data subject rights communications and ensure processes are in place to receive and address such complaints.

The United Kingdom has introduced new requirements governing how organizations receive and respond to data protection complaints from employees. Effective June 19, 2026, Section 164A of the Data Protection Act 2018 gives data subjects a statutory right to complain directly to a controller (usually their employer) if they believe the controller has infringed UK data protection laws, including the UK General Data Protection Regulation (UK GDPR) or applicable provisions of the Data Protection Act.

In light of these new statutory obligations, employers operating in the United Kingdom should evaluate whether their current privacy notices and grievance procedures satisfy the new requirements.

Controller Obligations Under the New UK Complaint Right

Controllers must facilitate the making of data protection complaints. The statute identifies an electronically completable complaint form as one mechanism but also leaves the door open for controllers to identify other mechanisms to intake complaints.

After receiving a complaint, a controller must:

  • Acknowledge receipt within 30 days beginning on the date the complaint is received;
  • Take appropriate steps to respond without undue delay;
  • Make inquiries into the subject matter of the complaint, to the extent appropriate;
  • Inform the complainant about the complaint’s progress; and
  • Inform the complainant of the outcome.

Practical Steps for Employers Operating in the United Kingdom

Organizations should review how potential data protection complaints are received and routed. Controllers should:

  • Update applicable employee privacy notices to inform UK employees of these rights;
  • Update internal DSR processes to address this new right, including adopting procedures for classifying and investigating such complaints;
  • Provide transparent complaint channels;
  • Assign responsibility and governance protocols for complaints and communications; and
  • Develop record-keeping procedures that identify the complaints made, the outcomes for such complaints and the basis for the outcome.

For more information on the UK's new data protection complaint requirements and how they may affect your organization's privacy compliance processes, please contact Greg Leighton, Aaron Ogunro or your preferred Polsinelli attorney.