Who does the 30-day duty apply to?

Section 164A applies to every UK data controller. There are no exemptions for size, revenue, or sector.

If your organisation handles personal data of UK residents — customers, employees, suppliers, or members — you are a data controller subject to this duty.

The four obligations

• 1. Facilitate complaints: You must provide a way for individuals to complain about how their personal data is handled.
• 2. Acknowledge: You must acknowledge every complaint within 30 days of receipt.
• 3. Respond: You must respond to the complaint without undue delay.
• 4. Evidence: You must keep evidence of the complaint, the acknowledgement, and the response for regulatory review.