UK GDPR: New Data Subject Complaint Right & Your Firm's Obligations

Understanding the New UK GDPR Data Subject Complaint Right

The landscape of data protection in the UK is continually evolving, and a significant change is on the horizon for all data controllers, including accounting and bookkeeping firms. Effective 19 June 2026, the Data (Use and Access) Act 2025 introduces a new statutory right for data subjects to complain directly to data controllers about how their personal data is being handled. This crucial update to the UK GDPR framework places a greater initial burden on organisations to resolve data protection concerns internally, before potential escalation to the Information Commissioner's Office (ICO).

Currently, data subjects possess a range of rights under UK GDPR, such as the right to access their data (Subject Access Requests), the right to rectification, erasure, restriction of processing, and data portability. While individuals have always been able to raise concerns with organisations, this new provision formalises and strengthens their ability to initiate a direct, statutory complaint. It mandates a structured response from data controllers, aiming to streamline the resolution process and potentially reduce the volume of initial complaints reaching the ICO.

This new UK GDPR data subject complaint right signifies a shift towards greater accountability at the data controller level. It underscores the importance of transparent and accessible internal mechanisms for addressing individual concerns about data processing practices.

Key Obligations for Data Controllers Under the Data (Use and Access) Act 2025

The introduction of this new right brings with it specific, legally binding obligations for all data controllers. Accounting firms, which process vast amounts of sensitive personal and financial data, must pay close attention to these requirements to ensure full compliance by the 19 June 2026 deadline.

Establish Clear Complaint Channels: Firms must provide easily accessible and well-publicised methods for data subjects to lodge complaints. This could include a dedicated email address, a postal address, an online form on your website, or a specific telephone line. Transparency is key here.
Timely Acknowledgement: Upon receiving a complaint, data controllers will be obligated to acknowledge its receipt promptly. While the Act may specify exact timings, best practice suggests acknowledging within 3 working days, confirming the complaint has been received and outlining the next steps.
Thorough Investigation: Each complaint must be subject to a fair, impartial, and comprehensive investigation. This requires understanding the nature of the complaint, gathering relevant information, and assessing whether the firm's data processing activities align with UK GDPR principles and the Data (Use and Access) Act 2025.
Substantive Response: Firms must provide a clear, concise, and substantive response to the data subject within a specified timeframe. This response should explain the findings of the investigation, any actions taken or planned, and, if applicable, the data subject's right to escalate their complaint to the ICO if they remain dissatisfied. The timeframe is expected to be similar to Subject Access Requests, typically one calendar month from receipt, with extensions possible for complex cases.
Maintain Detailed Records: It is a critical obligation to keep accurate and comprehensive records of all complaints received, the investigations conducted, the decisions made, and the responses provided. This documentation will be vital for demonstrating compliance to the ICO if required. This aligns with broader record-keeping requirements for AML compliance and registered office obligations.

Building Robust Internal Complaint Handling Procedures

To effectively meet these new obligations, accounting firms need to move beyond ad-hoc responses and implement structured, robust internal complaint handling procedures. This proactive approach will not only ensure compliance but also build trust with clients and reduce the risk of regulatory intervention.

Developing a Comprehensive Complaint Policy

Your firm should develop a clear, written policy outlining the entire complaint handling process. This policy should cover:

Who is responsible for overseeing data protection complaints (e.g., your Data Protection Officer or a designated senior manager).
The various channels through which a data subject can submit a complaint.
The steps involved in acknowledging, logging, investigating, and responding to a complaint.
Defined timelines for each stage of the process.
An internal escalation matrix for complex, high-risk, or unresolved complaints.
Templates for acknowledgement letters and final response letters, ensuring consistency and legal accuracy.

Leveraging Digital Tools for Efficiency

Modern digital tools can significantly streamline your complaint handling. Implementing a dedicated system or utilising features within existing client management platforms can help with:

Centralised logging and tracking of all complaints.
Automated reminders for deadlines.
Secure storage of all communication and investigation documentation.
Reporting and analytics to identify common complaint themes and areas for improvement.

Investing in appropriate technology can transform a potential compliance burden into an efficient, auditable process.

Training Your Team: The Human Element of Compliance

Even the most meticulously crafted policies are ineffective without well-trained staff. The human element is paramount in successful data protection compliance, especially with the new UK GDPR data subject complaint right.

Awareness and Identification Training for All Staff

Every member of your firm, from front-office staff to senior partners, needs a basic understanding of this new right. They must be able to:

Recognise when an incoming communication constitutes a data protection complaint, regardless of how it's phrased.
Understand the immediate steps to take, such as logging the complaint and escalating it to the designated person or team.
Be aware of the importance of not attempting to resolve the complaint themselves without proper training, to avoid missteps.

Specialised Training for Complaint Handlers

For those directly responsible for managing and investigating complaints, more in-depth training is essential. This should include:

Detailed knowledge of UK GDPR principles and the Data (Use and Access) Act 2025.
Guidance on conducting fair and thorough investigations, including evidence gathering and decision-making.
Training on effective communication with data subjects, ensuring responses are clear, empathetic, and legally sound.
Scenario-based training to prepare staff for a variety of complaint types and complexities.
Regular refreshers to keep staff updated on any changes in guidance or legislation.

Effective training fosters a culture of data protection responsibility across the firm.

Enhanced ICO Enforcement and the Risks of Non-Compliance

While the new right aims to resolve more complaints at the controller level, the Information Commissioner's Office (ICO) remains the ultimate authority for data protection in the UK. Data subjects who are dissatisfied with your firm's response, or who do not receive a timely response, retain their right to complain directly to the ICO.

ICO's Continued Oversight and Powers

The Data (Use and Access) Act 2025 is expected to reinforce the ICO's enforcement capabilities. Failures in establishing adequate complaint handling mechanisms, or in responding appropriately, could lead to:

Investigations and Audits: The ICO can initiate investigations into your firm's data handling practices and conduct audits of your compliance measures.
Enforcement Notices: The ICO can issue enforcement notices, requiring your firm to take specific actions to remedy non-compliance.
Significant Fines: Non-compliance with UK GDPR can result in substantial penalties, up to £17.5 million or 4% of your firm's global annual turnover, whichever is higher. Systemic failures in handling statutory complaints could easily fall into this category.
Reputational Damage: Beyond financial penalties, public enforcement actions by the ICO can severely damage your firm's reputation and client trust. This can have long-lasting commercial consequences.

Proactive compliance with the new complaint right is your best defence against ICO intervention and the associated risks.

Preparing Your Firm for 19 June 2026: A Practical Checklist

The 19 June 2026 deadline for the Data (Use and Access) Act 2025 and the new UK GDPR data subject complaint right will arrive quickly. Accounting firms should start preparing now to ensure a smooth transition and full compliance.

Here's a practical checklist to guide your preparations:

Review Existing Data Protection Policies: Update your firm's privacy policy and internal data protection policies to reflect the new statutory complaint right and your firm's procedures for handling them.
Develop a Dedicated Complaint Handling Procedure: Create a detailed, step-by-step procedure document for receiving, logging, investigating, and responding to data subject complaints.
Designate a Lead for Complaints: Clearly assign responsibility for overseeing data protection complaints, whether it's your DPO, a compliance manager, or another senior individual.
Establish Clear Communication Channels: Ensure your website, privacy notices, and client communications clearly state how data subjects can make a complaint.
Implement a Complaint Logging System: Set up a robust system (digital or manual, though digital is recommended) to record every complaint, its progress, and its resolution.
Develop Response Templates: Draft standardised acknowledgement and final response templates to ensure consistency and efficiency.
Conduct Comprehensive Staff Training: Plan and deliver training sessions for all staff on identifying and escalating complaints, and more in-depth training for those directly involved in handling them.
Conduct a Readiness Audit: Perform an internal audit or a 'mock' complaint scenario to test the effectiveness of your new procedures and identify any gaps.
Consider Legal Counsel: Seek expert legal advice to ensure your procedures are fully compliant with the Data (Use and Access) Act 2025 and broader UK GDPR requirements.
Integrate with Existing Compliance Workflows: Ensure your new complaint handling processes integrate seamlessly with other compliance areas, such as onboarding new staff compliance checklists and HMRC deadlines, to avoid duplication and ensure holistic data governance.

By taking these proactive steps, your accounting firm can confidently meet its new obligations and reinforce its commitment to robust data protection.