Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 25 FEBRUARY 2026

Handling Data Protection Complaints Under The DUAA: Key Takeaways From ICO Guidance

Lewis Silkin
Lewis Silkin
Contributor
Lewis Silkin

Lewis Silkin

Joint managing partners: Jo Farmer, Richard Miskella International offices: Dublin, Hong Kong...

View firm profile
Explore more from Lewis Silkin

From 19 June 2026, the Data Use and Access Act 2025 (DUAA) will introduce a new, statutory "right to complain" for individuals in the UK regarding their data protection rights.

United KingdomPrivacy
Anushree Som
Anushree Som
Zahra Laher
Zahra Laher
Rachael Lawless
Rachael Lawless
Author LinkedIn connections

From 19 June 2026, the  Data Use and Access Act 2025 (DUAA) will introduce a new, statutory "right to complain" for individuals in the UK regarding their data protection rights. This right, set out in the new section 164A of the Data Protection Act 2018 and as inserted by DUAA, requires individuals to lodge a complaint directly with an organisation first before they can escalate it to the ICO. 

The ICO has published  guidance setting out how organisations should handle data protection complaints which we have summarised below.

What is a data protection complaint?

A data protection complaint arises when someone believes an organisation has infringed data protection legislation because of the way it has handled their personal data. For example, a complaint may relate to the way a data subject access requests was handled, what data security measures were applied to store someone's data in the event of a data breach, or how an organisation has collected or used

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

ICO Cookie Crackdown 2.0: The ICO’s New Storage And Access Technologies Guidance

The UK Information Commissioner's Office has finalized its guidance on storage and access technologies, expanding compliance requirements beyond traditional cookies to include tracking pixels, device fingerprinting, and web storage. Organizations must now navigate stricter consent standards and three new narrow exceptions introduced by the Data (Use and Access) Act 2025, while facing significantly increased enforcement penalties of up to £17.5 million or 4% of annual worldwide turnover.
United KingdomPrivacy
ZwillGen
ZwillGen
Article

European Commission Press Release: EU AI Act Transparency Enforcement Starts This Sunday! Do You Know Who Your Chatbots Are? We Break Down The Commission’s Guidelines On Transparency Below

The European Commission has announced that EU AI Act transparency rules take effect August 2, 2026, requiring chatbots to identify themselves, deepfakes to be labeled, and AI-generated content to be marked. Organizations must assess whether their AI systems trigger disclosure, labeling, or content-marking requirements, with limited exceptions and penalties reaching €15 million or 3% of global turnover for noncompliance.
GlobalPrivacy
Seyfarth Shaw LLP
Seyfarth Shaw LLP
Article

ICO Launches Consultation On Draft Guidance Regarding Anonymisation And Pseudonymisation For Research Purposes

The UK's Information Commissioner's Office has opened a public consultation on draft guidance addressing anonymisation and pseudonymisation techniques for processing personal data in research, archiving, and statistical contexts. The guidance explores critical distinctions between anonymous and pseudonymous data, outlines required safeguards under UK GDPR, and examines emerging technologies including synthetic data and privacy-enhancing tools.
United KingdomPrivacy
A&O Shearman
A&O Shearman
Article

ICO Consults On Draft Guidance On Anonymisation And Pseudonymisation For Research

The Information Commissioner's Office has launched a consultation on draft guidance addressing anonymisation and pseudonymisation for research, archiving and statistical purposes. This guidance provides critical insight into how organisations should apply data minimisation principles in modern research practices, including AI development, trusted research environments, and synthetic data generation.
United KingdomPrivacy
Burges Salmon LLP
Burges Salmon LLP
Article

Revised Earned Settlement Policy To Be Unveiled Before The End Of 2026

The UK Home Secretary has confirmed that the revised earned settlement policy will be published before the end of 2026, following her appearance before the Home Affairs Committee. This announcement provides clarity on the timeline for implementing significant changes to the UK immigration system, including transitional arrangements and the extension of the default settlement period from five to ten years.
United KingdomImmigration
Lewis Silkin
Lewis Silkin
Article

Summary Of Autumn 2026 Immigration Rule Changes

The UK Home Office has introduced significant changes to its Immigration Rules, including new protections for Skilled Worker visa holders who are victims of modern slavery, measures to prevent abuse of fee waiver processes, and updates to support the UK's participation in Erasmus+ from January 2027. These changes also expand permitted activities for visitors coming to the UK for training or creative purposes.
United KingdomImmigration
Lewis Silkin
Lewis Silkin
Article

What The 2026 Policy Address Means For Employers In Hong Kong

Hong Kong's Chief Executive has unveiled sweeping employment law reforms in the 2026 Policy Address, introducing statutory protections for delivery workers, tightening imported labour controls, and accelerating MPF system changes. These measures reflect the Government's commitment to protecting local workers while addressing the challenges of an ageing workforce and evolving labour market dynamics.
Hong KongEmployment and HR
Lewis Silkin
Lewis Silkin
Article

Game Developer And Publisher Battle Over Step In Rights

A High Court ruling examines a contentious dispute between a video game developer and publisher over milestone-based funding and "step in" rights for the first-person shooter Six Days in Fallujah. With over $50 million in development costs at stake and allegations of conspiracy to acquire proprietary source code, the court declined to grant either party interim control of the game's development, leaving both sides without the "keys to the kingdom" pending a full trial.
United KingdomLitigation, Mediation & Arbitration
Lewis Silkin
Lewis Silkin
Article

Hong Kong Cracks Down On Unpaid Wages With Director Sentencing

A Hong Kong director was sentenced to 120 hours of community service and ordered to pay HK$93,000 in outstanding wages after her companies failed to pay employees on time. The case demonstrates that corporate officers can face serious criminal liability, including fines up to HK$350,000 and three years' imprisonment, when employment law breaches occur with their consent, connivance, or neglect.
Hong KongEmployment and HR
Lewis Silkin
Lewis Silkin
Article

You're Owed Money. Now What? – A Practical Guide To Debt Recovery In Hong Kong

Hong Kong's debt recovery landscape has become increasingly challenging, with corporate insolvencies rising 45% in 2025 and bankruptcy petitions climbing to over 10,000. This comprehensive guide explores the legal pathways available to creditors, from initial demand letters to enforcement mechanisms, and examines when civil litigation versus insolvency proceedings may be the most effective strategy for recovering outstanding debts.
Hong KongInsolvency/Bankruptcy/Re-Structuring
Lewis Silkin
Lewis Silkin