The 30-day data-protection complaint duty.
The Data (Use and Access) Act 2025 inserts section 164A into the Data Protection Act 2018. It creates a strict duty for every UK data controller.
You must provide a way for individuals to complain about how their personal data is handled. You must acknowledge that complaint within 30 days. You must respond without undue delay. And you must keep an auditable trail of all of it for the ICO.
The practical 30-day clock →
What counts as day one, and what an acknowledgement requires.
Who does it apply to? →
The four obligations that apply to every UK organisation.
What an ICO evidence pack looks like →
The audit trail the regulator expects to see.
The statute: s.164A in full →
Annotated text of section 164A with our plain-English reading.
Handle the duty, end to end.
Built to ICO guidance.