New Data Protection Complaints Requirements
New requirements relating to data protection complaints came into force in June 2026.
As data controllers, parish and town councils should have a clear process in place allowing individuals to raise concerns about how their personal information has been handled.
Complaints might relate to:
- How personal data has been collected, used, shared, stored or retained
- The handling of a subject access request
- Another request made under UK GDPR rights
Councils should review their existing complaints arrangements and ensure data protection concerns can be:
- Recognised and acknowledged within 30 days
- Investigated without undue delay
- Followed up with a clear outcome
What Should Councils Do Now?
Councils may wish to review their existing complaints policy and data protection procedures to make sure it is clear how an individual can raise a data protection concern, who is responsible for dealing with it and how the complaint will be recorded and followed up.
It may also be useful to ensure councillors and staff know how to recognise a data protection complaint so that it can be directed to the appropriate person promptly.
If your existing complaints process already meets these requirements, no further action may be needed.