New duty on data protection complaints

A significant change to UK data protection law came into force on 19 June 2026. Under the Data (Use and Access) Act 2025, employees and other individuals now have a legal right to raise data protection concerns directly with an organisation before taking their complaint to the Information Commissioner’s Office (ICO).

For HR professionals, this means that data protection issues are increasingly likely to land on your desk first.

Workplace data protection complaints

Complaints could cover a wide range of workplace issues, including employee monitoring, mistakes in personnel records, delays in responding to subject access requests, inappropriate sharing of personal information, or concerns about how artificial intelligence (AI) is being used in employment decisions.

One important point for HR teams to understand is that employees do not need to use legal language when raising a concern. They may not even describe it as a complaint. For example, an employee saying, ‘I don’t think you should be using my information like that’ could be enough to trigger an organisation’s obligations under the legislation.

Handling employee data protection concerns

The new law requires organisations to have a process for handling data protection complaints. Employers must acknowledge complaints within 30 days and investigate and respond without unnecessary delay. Failing to do so could potentially amount to a breach of data protection law in its own right.

This represents an important change in practice. In the past, many data protection concerns were raised directly with the Information Commissioner’s Office. Employers are now expected to deal with these issues internally, wherever possible, and to demonstrate that they have effective procedures in place for receiving, investigating and resolving complaints.

HR teams should review their current arrangements now to ensure data protection complaints are identified and handled properly. Policies and procedures may need updating, and reporting channels should be clear, accessible and easy for employees to use. Managers should also be trained to recognise when a concern amounts to a data protection complaint, with clear escalation routes in place so issues are referred promptly to the right people within the organisation.

Here to help

Our Employment team at Longmores helps employers review workplace policies, procedures and reporting channels to manage employment-related data protection issues and reduce the risk of complaints. If you need advice on handling workplace data protection complaints or updating your internal procedures, please contact Miranda Mulligan, Senior Solicitor, in our Employment Law team.

Please note, the contents of this article are provided for information only and must not be relied upon. Legal advice should always be sought in relation to specific circumstances.