Requirement for data protection complaints procedure

Implementation date: 19 June 2026

The Data (Use and Access) Act 2025 introduces a requirement for organisations to have a data protection complaints procedure in place. This includes a procedure for use by employees and job candidates, where they believe their data protection rights have been breached.

Organisations must:

• take steps to enable data subjects to make complaints, for example by providing a form to complete;
• acknowledge receipt of complaints within 30 days; and
• respond to the complaint and inform the complainant of the outcome, without undue delay.