Since 19 June 2026, dealing with data protection complaints has been a legal duty.
It applies to UK organisations responsible for people's personal information. Data protection law calls them "controllers". The ICO says there are no exemptions.
When a customer, member of staff or club member complains about how you've used their details, you need somewhere for that complaint to go. Set up a procedure, a form and a log first. When a complaint arrives, follow the steps.
The duty is in section 164A of the Data Protection Act 2018, added by the Data (Use and Access) Act 2025. You must make it easy for people to complain and acknowledge each complaint within 30 days. You must also look into it, keep the person updated and tell them the outcome. This pack turns that into a procedure, a form, three letters and a log you can adapt to your business.
£19 · digital download (ZIP file).
Duties and suggestions, marked as such
Each step is marked as a legal duty, something the ICO says you must or should do, an optional extra, or our own suggestion. This follows the ICO's own "must, should, could" approach. So you'll know which parts are duties and which are extras.
What's inside
- Complaints procedure (Word and PDF): a public part to put on your website, and an internal checklist for your team
- Complaint form in three formats: a field list to paste into an online form builder, a Word form for email or post, and a fillable PDF
- Three letter templates: acknowledgement, progress update and outcome, with optional paragraphs for ID checks and complaints made for someone else
- Complaints log (Excel and CSV) including the records the ICO says you should keep. The Excel version works out the 30-day acknowledge-by date from the date received. It uses the ICO's counting rule, skipping weekends and any bank holidays you list
- "Start here" set-up guide: a step-by-step plan, plus a short "when a complaint arrives" checklist
- Web form wording and a two-line privacy notice insert: ready to paste into your website and privacy notice
- One-page "who handles it" card for businesses of one to five people: who deals with complaints, who covers, and the six steps
- Sources list at the end of the guide, procedure and letters: the legislation.gov.uk and ico.org.uk pages the pack is based on, so you can check them yourself
Setting it up
- Click Get the kit and check out. You'll receive a download link after payment.
- Open the "Start here" guide.
- Fill in the square-bracket fields with your business details.
- Put the form online, publish the procedure and save the log.
- When a complaint arrives, follow the checklist and use the letters.
Editing happens at your end, and there's nothing to schedule with us.
Who it's for
- UK small businesses, sole traders, charities and clubs that hold customer, staff or member details
- Anyone who doesn't have a data protection complaints process yet, or wants to add data protection complaints to an existing one
- Owners who'd like the log to work out each acknowledge-by date for them
FAQ
Does this apply to small businesses?
The ICO's guidance says organisations must have a process for handling data protection complaints, and that "there are no exemptions to this".
Do I have to resolve a complaint within 30 days?
No. You must acknowledge it within 30 days. The ICO counts the 30 days from the day after you receive the complaint. If the last day is a weekend or public holiday, you have until the next working day. There's no fixed legal deadline for the outcome. You must still look into it and tell the person the outcome without undue delay.
Can I add this to the complaints process I already have?
Yes. The ICO says there's "no obligation to produce a separate or standalone process for data protection complaints". The procedure works on its own, or you can fold it into what you have.
Is a complaint the same as a subject access request?
No. The ICO treats them as separate, each with its own rules. The pack explains the difference. The log has a column to note a linked request.
What formats are the files?
Word (.docx), PDF (including a fillable form), Excel (.xlsx), CSV and plain text. They open in Microsoft Office, Google Docs and Sheets, LibreOffice and most PDF readers.
Does it cover Scotland and Northern Ireland?
Yes. Section 164A applies in England, Wales, Scotland and Northern Ireland. Bank holidays differ between them, so you list your own on the log's Bank holidays tab.
Everything in the download
A ZIP with 12 files: the Start here guide (PDF), the complaints procedure (Word and PDF), the complaint form (Word, fillable PDF, and a field list in two text formats), the letter templates (Word), the complaints log (Excel and CSV) and the "who handles it" card (Word and PDF).
Honest scope
This is a set of templates to adapt. General information, not legal advice. Using it doesn't on its own mean your business meets the law. That depends on how you put it into practice. It covers data protection complaints only. Other complaints, and requests such as subject access requests, follow their own rules.
If you'd rather hand the whole job over, a data protection consultant or a solicitor can write a procedure for you. They can also advise on your own situation.
Behind the pack
Secordit Intelligence was set up in February 2026 by Matthew Protheroe-Hill, its director. Before that, he co-founded Sencode Cyber Security and was a director there from 2019 to 2023. Qualification: BSc (Hons) Cyber Security & Networks (1st Class), Teesside University.
Delivery
Digital download (ZIP file). You'll receive a download link after payment.
Before anything else, fill in the square-bracket fields, using the "Start here" guide.