How to Complain to the ICO | When Will They Respond?

What changed on 19 June 2026?

Section 103 of the Data (Use and Access) Act 2025 brought new controller complaint-handling duties into force for complaints received on or after 19 June 2026. Organisations must provide a way to make a data-protection complaint, acknowledge receipt within 30 days, investigate it appropriately, keep the person informed where necessary and give the outcome without unjustifiable or excessive delay.

30 days is an acknowledgement deadline

It is not a universal 30-day deadline for the organisation to finish every complaint. If it can investigate and give an outcome within 30 days, a separate acknowledgement may be unnecessary; otherwise it must acknowledge and continue the investigation without undue delay.

Complain to the organisation first where appropriate

The ICO's current public guidance recommends giving the organisation an opportunity to resolve the issue through its complaint process. You can approach the ICO, but it may need the organisation's reply and evidence of the steps already taken. This is particularly important for SAR handling, data accuracy, erasure, security and other individual-rights complaints.

What to put in the complaint

What happened and the relevant dates.
Which data-protection right or handling issue is involved.
What you think the organisation got wrong.
The practical outcome you want.
Copies of the request, response and other key evidence.

When to go to the ICO

If the organisation does not resolve the issue, you can complain to the ICO. The ICO advises people to raise complaints within three months of their last meaningful contact with the organisation because delay can affect whether and how the complaint is considered.

FOI and EIR are different

For FOI and EIR disputes, use the authority's internal review/reconsideration process first in the normal way. The controller-complaint duties introduced by the DUAA are about data-protection complaints; they do not replace the FOIA/EIR review framework.

What the ICO does

The ICO considers complaints under its statutory functions and may seek information, provide views on compliance, make recommendations or use regulatory powers where appropriate. It is not an ombudsman for every service dispute and does not award compensation through the complaint process.

Complaint template

Subject: Data protection complaint I am making a complaint about how you have handled my personal information / data-protection rights. Issue: [brief description] Relevant dates: [dates] Why I say the handling was wrong: [reasons] Outcome sought: [what would resolve it] Please acknowledge this complaint under your data-protection complaints process and investigate it. Please provide a reasoned outcome and tell me about my right to complain to the Information Commissioner's Office if the matter is not resolved. Yours faithfully, [Name]

Official sources

Reviewed September 2026. This page is general information, not legal advice. For a live dispute or critical deadline, check the current ICO guidance and legislation.