Policy & regulation · Jun 26
The DUAA Complaints Framework Is Now Enforceable: Every UK Data Controller Needs an Internal Front Door
Since 19 June 2026, all UK GDPR controllers must handle data complaints internally before individuals can escalate to the ICO. No exemptions, no size threshold.
- Every UK GDPR controller, with no size exemptions, must have a formal internal complaints process in place; individuals must use it before escalating to the ICO, with a typical 45-day response window.
- During a cyber incident, inbound contacts from affected individuals can constitute regulated complaints under the DUAA, so incident response runbooks now need an explicit complaints-handling branch.
- Privacy notices must be updated to reflect the new complaint right, and staff who handle inbound communications need training to distinguish regulated complaints from routine data queries.