Since 19 June 2026, UK organisations that handle personal data have had a specific legal duty to operate a process for data-protection complaints. For small firms, this does not mean buying an expensive case-management platform or creating a department overnight. It does mean being able to show that a complaint can reach the right person, be acknowledged on time, investigated sensibly, answered clearly and used to improve the business.
The change comes through the Data (Use and Access) Act 2025. The Information Commissioner’s Office (ICO) has confirmed that the complaints provisions are now in force for all organisations handling personal data. The core duties are straightforward: give people a way to complain, acknowledge receipt within 30 days, take appropriate steps to investigate without undue delay, keep the person informed and communicate the outcome without undue delay.
That is the legal baseline. The practical challenge is making it work when the person who receives an email may be a sales manager, shop supervisor, founder or outsourced customer-service provider. A lightweight, repeatable workflow is the answer. Here is how UK small business owners can put one in place and keep it running.
What counts as a data-protection complaint?
Do not wait for someone to write “UK GDPR breach” in the subject line. A person does not need legal language to make a data-protection complaint. In the ICO’s guidance on what constitutes a complaint, examples include concerns about how an organisation handled a subject access request, the accuracy or retention of personal data, marketing use, data security or a personal-data breach.
A complaint may arrive as an email saying, “You have ignored my request to stop emailing me,” a Google review alleging that employee information was exposed, a phone call about a wrong address on an account, or a message asking why a business has kept customer data for years. Treat the data-protection element as a potential complaint even if it is mixed with a service complaint, refund dispute or employment grievance.
There is an important distinction. A customer who complains that a delivery was late while asking for a copy of their information has made a service complaint and a rights request; that is not automatically a data-protection complaint. Equally, a staff grievance plus a subject access request does not automatically make the grievance a data complaint. Separate the issues, but do not use the distinction to ignore a genuine concern about personal information. If the message is unclear, ask the person promptly to clarify what aspect of data handling they want investigated.
The minimum compliant workflow: receive, acknowledge, investigate, close
A small firm should document one route from first contact to closure. The following five-stage workflow is designed to be proportionate: it can run from a shared mailbox, a restricted spreadsheet or an existing customer-service system, provided records are organised, secure and accessible to the people who need them.
1. Receive and capture every possible complaint
Start by making it easy for people to complain directly to you. The ICO says a business can use an email address, form, telephone line, online portal, live chat escalation or in-person method. You do not have to build a dedicated new tool if an existing complaints channel can do the job.
Publish a clear route in the privacy notice and on the contact or complaints page. For most SMEs, an address such as privacy@business.co.uk or complaints@business.co.uk, monitored by more than one authorised person, is enough. State that people can explain what happened, provide relevant dates or correspondence and say what resolution they seek. Do not insist on a particular form: people can complain through other routes and even to individual employees, and the organisation must accept the complaint however it arrives.
Build an internal forwarding rule. Every team member should know that any message about personal data, a rights response, marketing, inaccurate records, security or a suspected disclosure must be sent on the same working day to the nominated complaint owner. This includes social-media messages. Do not discuss a person’s data publicly in a direct-message thread or comment; instead, acknowledge the contact briefly and move them to a secure channel.
Log the case immediately. Assign a reference number and record the date and time received, channel, complainant’s contact details, a concise issue summary, systems involved, owner, acknowledgement deadline and risk flags. The date of receipt matters because the acknowledgement clock starts the day after the complaint arrives.
2. Triage, verify and assign ownership
Before investigating details, triage the case. Is this a data-protection complaint, a rights request, a potential personal-data breach, a general customer complaint, or more than one of these? A single email may trigger several workstreams. For example, an individual could complain that they received someone else’s invoice, ask for their own data and request erasure. The disclosure may need breach assessment, the access and erasure requests have their own legal handling requirements, and the complaint must still be managed through this process.
Check identity proportionately before disclosing information or discussing an account. The ICO says that where there is doubt, an organisation may ask for ID at the earliest opportunity, but must not demand more information where it already has enough to establish identity. Where somebody is acting for another person, check authority, such as a signed letter of authority or appropriate power of attorney, before investigating on that person’s behalf.
Then allocate a named case owner and a decision-maker. In a microbusiness these may be the same person, but avoid having the subject of the complaint decide it alone where possible. If the complaint concerns the marketing lead’s campaign, the owner might gather evidence while a director, external data-protection adviser or another manager signs off the outcome. Escalate immediately where there may be ongoing harm, a live security incident, special-category data, a child’s information, a high-volume processing issue or significant reputational risk.
3. Acknowledge within 30 days, but do not wait 30 days to act
The formal requirement is to acknowledge receipt within 30 days. The ICO explains that the 30 days begin on the day after receipt; if the final day falls on a weekend or public holiday, the acknowledgement may be provided on the next working day. A business that resolves a straightforward case and provides the full outcome within that period does not need to send a separate acknowledgement.
Operationally, acknowledge much earlier. A same-day or next-working-day acknowledgement reduces anxiety, confirms the right contact details and protects against missed deadlines. It also creates a clear audit trail. Use a human-reviewed template rather than a bare automated response where possible.
Your acknowledgement should confirm the reference number, summarise the issue in plain English, say that you are looking into it, name or identify the contact point, and request any genuinely necessary clarification, identification or evidence. Give a realistic next-update date. Do not promise a resolution date that the business cannot meet; the law requires action without undue delay, not a one-size-fits-all final deadline.
- Simple acknowledgement wording: “We have received your data-protection complaint on [date] and registered it as [reference]. We are reviewing your concerns about [brief summary]. [Name/team] is your contact point. We will update you by [date]. Please send [specific missing information] if you have it.”
4. Investigate promptly and proportionately
The investigation duty begins when the complaint is received, not after the acknowledgement is sent. The ICO’s complaints-handling guidance says organisations should make appropriate enquiries without undue delay. What is appropriate depends on the facts, complexity, scale and potential harm. A small issue about one inaccurate phone number may need only an account check and correction. A complaint that a mailing list was shared with a supplier may require an audit of exports, contract terms, staff interviews and breach assessment.
Create a short investigation plan in the case record. List the allegation, the questions to answer, the evidence needed, responsible people, deadline for each task and next customer update. Gather relevant records rather than relying on memory: CRM notes, consent history, email-platform suppression logs, website form settings, access logs, relevant policies, processor correspondence and copies of earlier rights responses. Preserve records that may otherwise be overwritten under normal system settings.
Test the complaint fairly. Compare what the person says with what the systems show, speak to staff who made relevant decisions and check whether the business followed its privacy notice, retention schedule, internal policy and contractual commitments. Ask what outcome the individual wants. They may want a correction, explanation, deletion, marketing suppression, apology or process change. Knowing this does not decide the legal answer, but it can narrow the work and help resolve a case constructively.
If the matter takes longer than expected, update the complainant before the date you gave. Explain the reason in clear terms, say what remains to be done and provide a revised expected date. Avoid disclosing another person’s data or confidential security details in an update. Silence is risky: keeping people informed is itself part of the new duty.
5. Close with a clear outcome and corrective action
Once the facts are established, provide the outcome without unjustifiable or excessive delay. The response should deal with each material point, not simply state “we found no breach”. Explain what the business checked, the conclusion reached and the action taken or planned. Where the business made a mistake, say so plainly, apologise where appropriate and set out the remedy. Where it believes its processing was lawful, explain the reasoning at a level the individual can understand and support it with relevant evidence where suitable.
It is good practice to tell the complainant that they may raise the matter with the ICO if they remain dissatisfied. The ICO also notes that a business may offer a review route, although a person does not have to wait for an internal review before complaining to the regulator. A modest SME review process can be as simple as having a director or independent adviser reconsider a disputed outcome within a stated period.
Closure is not merely sending the email. Complete promised actions, such as correcting a record, suppressing marketing, retraining a staff member, changing a form or tightening supplier instructions. Give each action an owner and due date. Only mark the case closed when the outcome has been sent and the required remedial work is complete or formally tracked to completion.
Put ownership in writing
The biggest small-business failure is not bad intent; it is an orphaned inbox and unclear responsibility. Name a complaints lead, a deputy for holidays and sickness, and a senior person who can approve high-risk outcomes. The lead does not need to be a statutory data protection officer. They do need authority to obtain information from colleagues, chase suppliers and escalate serious issues.
Make the workflow part of onboarding and annual data-protection training. Staff should recognise complaint language, know how to forward it securely and understand that they must not make informal promises, delete evidence or argue with a complainant. Train outsourced reception, customer-support and marketing providers too. If a processor receives a complaint, the controller remains responsible for meeting the duties. Contracts and working instructions should require the processor to forward complaints immediately and provide the information needed for an investigation.
Joint-controller arrangements need even more care. The ICO advises that the clock begins when any joint controller receives the complaint. Agree the central contact point, who leads the investigation, who communicates with the individual and how evidence will be shared securely before a complaint arrives.
Use a complaint register that proves what happened
Good records turn a stressful exchange into a manageable case. The ICO recommends recording the receipt date, acknowledgement, relevant conversations and documents, outcome and actions taken. It also recommends using complaint numbers and recurring themes to identify compliance issues. Keep the register access-controlled: it will contain personal data and potentially sensitive allegations.
A practical register can include: reference number; received date; acknowledgement due date and actual date; source channel; issue category; identity or authority check; systems and suppliers involved; risk level; named owner; investigation steps; documents reviewed; updates sent; outcome date; decision summary; remedial actions; closure date; and retention review date. Link to files in a restricted case folder rather than pasting unnecessary personal data into the register.
Set a retention period that is justified by your complaint, legal and limitation-risk needs, then securely delete or anonymise case material when it is no longer necessary. Do not confuse good documentation with keeping everything forever. The ICO specifically warns that personal information must not be retained longer than needed.
A worked example for a small online retailer
Imagine a three-person online retailer receives an email from Priya stating that she opted out of marketing two months ago but has received three more promotions. She also says her account still shows an old address and asks why it has not been corrected.
On the day of receipt, the team member forwards the email to the privacy inbox. The complaints lead opens case DP-026, logs the arrival date, categorises it as marketing and accuracy, and checks that the email address matches Priya’s customer account. The lead acknowledges the complaint the next working day, confirms it is being investigated and says Priya will receive an update within five working days.
The lead checks the e-commerce platform, CRM and email provider. The evidence shows the opt-out was recorded in the CRM but a manually exported campaign list, created before the opt-out, was reused later. The address correction request was missed because a support ticket was closed without updating the CRM. The owner immediately applies the suppression across systems, corrects the address, confirms no further export lists remain and asks the marketing colleague to stop using local copies.
The final response explains the two findings, confirms the corrections, apologises and describes the control changes: a single approved marketing audience, a pre-send suppression check and a weekly sync exception report. The register records the evidence, response and actions. At the monthly review, the owners see two other complaints linked to manual exports and decide to remove staff access to download marketing lists. That is the point of the process: resolving an individual concern while finding the operational weakness behind it.
Common mistakes to avoid
- Using a generic customer-service queue with no data flag: the complaint may be answered informally but never logged, investigated or escalated.
- Counting 30 days from when the privacy lead sees the message: the timing starts after the organisation receives it, including when it reaches another employee or relevant channel.
- Waiting for ID before doing any internal work: verify identity before disclosing personal information, but start preserving evidence and assessing the issue promptly.
- Holding every issue until a wider complaint concludes: if the data-protection issue can be resolved sooner, deal with it sooner unless there is a genuine reason not to.
- Closing after sending an apology: record and complete the corrective action, then examine trends.
- Forgetting absence cover: a single-owner inbox with no deputy is not a reliable process during leave, illness or peak trading periods.
Make this a 30-day operational improvement
The new duty is already in force, so the right time to build the process is now. This week, nominate an owner and deputy, create a monitored complaint route, update the privacy notice and configure a secure register. Next, write acknowledgement and outcome templates, train staff to forward concerns and test the workflow with a realistic scenario. Then review cases quarterly for repeat causes, overdue actions and whether your published route still works.
Small firms do not need bureaucracy for its own sake. They need a process that is visible to customers, understood by staff and evidenced in records. Read the ICO’s full data-protection complaints guidance, adapt the workflow to your business and run a test case before a real complaint puts the system under pressure.
