Data Protection Complaints In The Employment Context And DSARs – Q&A

The Data (Use and Access) Act 2025 introduced a new "right to complain" to controllers regarding general UK GDPR compliance.

Further, the ICO has set out in its new complaints guidance that should someone choose to complain to the ICO in the first instance in most cases the ICO will ask complainants to raise the complaint with the controller before escalating it to them if necessary. This means controllers must have a way of receiving and managing these complaints, providing an acknowledgement and outcome in the required timescales.

We anticipate that this new right will become another tool used to leverage data protection rights against organisations, enabling data subjects to advance an underlying grievance, whether that be an employment complaint, a consumer issue or other challenge.