What Do The New Data Protection Complaint Requirements Mean For Employers?

Since 19 July 2026, organisations that handle personal data have been required to have a process for dealing with data protection complaints under the Data (Use and Access) Act 2025 (DUAA).

The new rules are designed to make it easier for individuals to raise concerns directly with organisations about how their personal information has been collected, used, stored or shared. They also encourage organisations to resolve concerns at an early stage, reducing the likelihood that complaints escalate to the Information Commissioner’s Office (ICO).

The requirements apply to any organisation that processes personal data. This means complaints could come from employees, job applicants, customers, service users or anyone else whose information you handle. In this article, we focus on the employer perspective, as employers routinely collect, use and store significant amounts of personal data throughout the employment relationship. However, the same obligations apply regardless of who makes