The recently enacted Data (Use and Access) Act 2025 introduces
some important changes to existing UK data protection laws.
One of these changes is the introduction of a new right
for individuals to complain to organisations about how their
personal data is managed by them.
On the face of it, the concept of data protection complaints is
nothing new – individuals already have various rights under
data protection laws to access their data, to have their data
erased, to object to direct marketing, etc. and often such rights
are exercised in the context of a complaint or dispute. However, at
present when individuals seek to complain specifically about data
protection matters, there is no specific process which
organisations must follow, or even an obligation to respond.
