Data protection complaints procedure template for UK practices
Give people an easy way to complain to your firm about how you use their personal information, and give staff the steps to handle each complaint. This data protection complaints procedure template is one Word document: a public notice, a staff procedure and an acknowledgement letter.
UK practicesGet this pack and 100 more for $129
What the procedure looks like
Who needs one
Since 19 June 2026 the Data Protection Act 2018 gives people the right to complain to an organisation that they think has broken data protection law. Every firm that handles personal information must make complaining easy, for example with a form that can be filled in online and by other means.
- Your website has no clear way to raise a data protection concern
- Your privacy notices need to tell people they can complain to you
- A client, former employee or job applicant has already raised a concern
- Staff don't know who to pass a complaint to, or what the deadline is
How to use the data protection complaints procedure template
- Add your contact details. Your complaint form link, email, postal address and phone number, and the name of your data protection lead.
- Publish the first page. Put the public notice on your website and give a copy to anyone who asks.
- Give staff the second page. Make sure everyone knows to pass complaints on the same day they arrive.
- Log every complaint. Record the date received and the acknowledgement deadline in your complaints log.
- Send the letter. Fill in the dates and send the acknowledgement letter, then the outcome in writing.
Questions
Do businesses have to have a data protection complaints procedure?
Yes. Section 164A of the Data Protection Act 2018, in force since 19 June 2026, says a controller must make it easy to complain, for example with a complaint form that can be filled in electronically and by other means.
How long do you have to respond to a data protection complaint?
You must acknowledge it within 30 days, starting when you receive it. After that, the law says you must respond without undue delay and tell the person the outcome. There is no fixed deadline for the outcome itself.
What must you do when you receive a data protection complaint?
Acknowledge it, take appropriate steps to respond, make enquiries into what happened where appropriate, keep the person informed of progress and tell them the outcome.
Can someone complain to the ICO instead?
People can still complain to the ICO. The procedure tells them how, both at the start and in your outcome letter.
Does a complaint have to be in writing?
No. A complaint can arrive by phone, email, post, an online form or social media, and the person doesn't need to use any particular words. The procedure has staff pass every one to the data protection lead the same day.
Also in the UK GDPR pack for practices
Who it's for
Accountancy practices that need a simple, public way to take data protection complaints.
Last checked
Checked against the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025 in November 2026.
