· ComplaintsDesk
What is Section 164A of the DPA 2018?
Section 164A of the Data Protection Act 2018 is the legal backbone of the UK’s new data protection complaints regime. It was inserted by section 103 of the Data (Use and Access) Act 2025 and took effect on 19 June 2026.
What does Section 164A do?
It creates a statutory right for data subjects to complain directly to a controller if they consider there is an infringement of UK GDPR or Part 3 of the DPA 2018 in connection with their personal data.
Controllers must:
- Facilitate complaints — e.g. by providing a form that can be completed electronically
- Acknowledge within 30 days — from the day after receipt
- Respond without undue delay — investigate, keep the complainant informed, and communicate the outcome
Why it matters
Before the DUAA, organisations could handle data concerns informally. Now every controller — with no size exemption — must have a documented, operational process.
The ICO encourages organisations to resolve complaints before individuals escalate to the regulator. A robust internal process reduces ICO complaints and demonstrates accountability.
What you should do
- Read our full DUAA complaints procedure guide
- Download the free procedure template
- Update your privacy notice to signpost how to complain