From 19 June 2026 there is a new employer obligation. It is to “facilitate and manage” data protection complaints (the Data (Use and Access) Act 2025).
It is a new statutory right for employees, and other individuals, to bring data protection complaints directly to their employer without first having to go to the Information Commissioner’s Office. There are no exemptions.
Employees can make a simple statement, rather than a formal “complaint”. They just need to say they are unhappy in some way about how their employer is using their information.
Employers must now facilitate and manage data protection complaints. That means that they must:
- Ensure there is a way employees can complain about data protection;
- Acknowledge complaints within 30 days of receipt;
- Take appropriate steps to respond to the complaint without undue delay: including making appropriate enquiries, and keeping people informed; and
- Inform the employee of the outcome without undue delay.
While a failure to do these things does not itself amount to a breach of data protection law, the responsibility for dealing with this type of complaint shifts to Employers and away from the Information Commissioner’s Office.
Employers must now demonstrate that they have effective systems for receiving, investigating, and resolving internal complaints about use of Employee’s information.