What to do when a customer complains about their personal data
Tom Whitfield
Writer
When a customer complains about how you handled their personal data, UK law now sets the order of play. Log the complaint the day it arrives, acknowledge it within 30 days, look into it without undue delay, keep the customer updated and tell them the outcome in plain language. The duty has applied to every organisation since 19 June 2026, and a simple, repeatable routine is enough for most small businesses.
What counts as a data protection complaint?
A data protection complaint is any message from someone who believes you have not followed data protection law with their information. The ICO's advice for small organisations puts it in those terms, and the customer does not need to say "complaint" or quote any law.
In a small business, a data protection complaint usually looks like an ordinary grumble. A customer still getting marketing emails after unsubscribing, a request for a copy of their data that went unanswered, an invoice sent to the wrong person, or a worried message after a data breach all count.
The trickiest part is spotting one. The ICO says you should make sure staff know how to recognise a complaint and what to do with it, because a data protection complaint can arrive by email, live chat, phone, post, a social media comment or a conversation at the counter.
Where does the 30 day rule come from?
The 30 day rule comes from section 103 of the Data (Use and Access) Act 2025 , which adds a new section 164A to the Data Protection Act 2018. Section 164A requires you to make complaining easy, acknowledge each complaint within 30 days, take appropriate steps to respond without undue delay and tell the person the outcome.
The rule took effect on 19 June 2026 . Michelmores' summary of the ICO guidance notes there are no exemptions for size or sector, so a sole trader with a booking form is covered as much as a large retailer.
Awareness is patchy. The ICO found that more than two in three businesses aware of the Act either did not know whether the changes applied to them or wrongly thought they did not.
The complaint handling routine, step by step
A complaint handling routine works best when anyone in the business can follow it without asking. Here is the sequence the law and the ICO guidance point to.
- Log the complaint the day it arrives. Note the date, who complained, how they got in touch and what they are unhappy about.
- Acknowledge the complaint. Confirm you have received it and will look into it, well inside 30 days.
- Start looking straight away. The investigation runs alongside the acknowledgement period, not after it.
- Keep the customer posted. Give an expected timescale and explain any delay.
- Send the outcome. Explain what you found and what you have done, point by point.
- File the record. Keep the log, the replies and the outcome together.
Each of these steps is small on its own. The risk for a busy business is a complaint that sits in a shared inbox for six weeks because nobody owned it.
How do you acknowledge a data protection complaint?
You acknowledge a data protection complaint by confirming you have received it and that you will look into it, within 30 days. The ICO explains the counting : the 30 days start the day after you receive the complaint, whether or not that day is a weekend or public holiday. If the last day falls on a weekend or public holiday, you have until the next working day.
For complaints sent electronically, an automatic reply is acceptable. For a complaint made by phone or in person, the ICO suggests summarising the issue back to the customer, asking how they would like to receive updates, giving a reference number if you use them and confirming someone will be in touch.
Thirty days is the legal limit, not a target. A same day acknowledgement costs nothing and takes the heat out of most complaints.
How do you investigate a complaint about personal data?
You investigate a complaint about personal data by working out what happened to that person's information and whether you followed the law. The Act calls this "making enquiries into the subject matter of the complaint, to the extent appropriate", so a simple complaint needs a simple check and a serious one needs more.
In practice that means looking in the places the data lives. Check your email marketing tool for the unsubscribe date, your booking system or customer database for what was stored, and your sent items for what was shared and with whom.
The ICO says you must keep the customer updated on progress without undue delay. That means timescales and the reasons for any delay, not a running commentary on every step.
How should you tell the customer the outcome?
You tell the customer the outcome in writing, in plain language, answering each part of their complaint in turn. The ICO's small business advice suggests listing the complaint areas as bullet points, responding to each one and providing evidence where you can.
Say what you found, what you have changed and anything you will do next. If you got something wrong, say so and explain the fix, for example that you have removed them from a mailing list and corrected the setting that kept them on it.
It is good practice to close by reminding the customer that they can complain to the ICO, with its contact details. You must also tell people about that right when you collect their data, which usually means a line in your privacy notice.
What happens if the customer goes to the ICO?
If the customer goes to the ICO, the regulator will normally expect the complaint to have been raised with you first. The ICO advises the public to give the organisation a chance to deal with it, and Michelmores notes that the ICO will weigh seriousness, harm and the public interest before acting.
Your log and replies become your evidence at that point. A dated record showing a prompt acknowledgement, a real investigation and a clear outcome is the best answer you can give a regulator.
The ICO says its focus is helping organisations get this right rather than catching them out. That is a reason to set the routine up calmly now, not a reason to leave it.
Where your website and systems make this easier
Your website and systems can do most of the routine for you. A named contact route for data concerns on the contact page and in the privacy notice makes complaining easy, which is the first legal duty.
A short web form can send an automatic acknowledgement, give each complaint a reference and drop it into a log with the date already filled in. In a web app with customer accounts , a "raise a data concern" link in account settings does the same job, and in a mobile app an in app route is easier for customers than hunting for an email address.
None of this needs a rebuild. For most small businesses it is a form, an email rule and a spreadsheet, wired together so nothing depends on someone remembering.
If you would like a straight answer on how your site or app should handle data complaints, book a free 15 minute call .
Frequently asked questions
Can a data protection complaint be made verbally?
Yes. A customer can raise a data protection complaint by phone or face to face, and the 30 day acknowledgement period still applies. Write it down the same day and confirm back what you understood.
Do I have to reply to a complaint made on social media?
Yes, a complaint made on social media still counts. The ICO discourages handling personal details in public posts, so ask the customer for a private contact method and carry on from there.
How long should I keep complaint records?
Keep complaint records only as long as you need them, because data protection law applies to the complaint file too. Set a retention period in your privacy notice and delete old records when it ends.
Is there a fixed deadline for the final outcome?
No. The law requires the outcome without undue delay rather than within a set number of days. Give the customer a realistic date in your acknowledgement and explain any change to it.
Got an idea you want to build?
Start with a free 15 minute call. Honest advice, no pressure, and nothing to sell you.