Frequently asked questions — TheDutyDesk

Question 1

Does this apply to my business?

Accepted Answer

If you are a UK organisation that handles personal data — customers, employees, suppliers, members — yes. The duty applies to every UK data controller, regardless of size or sector.

Question 2

We're a small business. Are we really in scope?

Accepted Answer

Yes. The s.164A duty applies to every UK data controller — there is no size threshold and no revenue floor. If you hold customer details, employee records or supplier contacts, you hold the duty. The ICO's enforcement attention skews toward serious cases, but a single unhandled complaint is enough to open one.

Question 3

We already have a privacy policy. Aren't we covered?

Accepted Answer

No. A privacy policy is the document. The duty is the operational procedure. Receive complaints, acknowledge in 30 days, respond, evidence it. The policy doesn't satisfy the duty.

Question 4

We use Zendesk / a shared inbox. Why do we need this?

Accepted Answer

Zendesk and shared inboxes do not have a 30-day clock, an immutable audit log, or an ICO evidence pack. When the regulator asks, you'll be stitching screenshots and CSVs. We do it in one click.

Question 5

Will the ICO actually fine us?

Accepted Answer

The maximum fine is £17.5 million or 4% of worldwide turnover, whichever is higher. The ICO issued 28 monetary penalty notices in 2025, totalling approximately £19.6 million.

Question 6

Where is the data hosted?

Accepted Answer

In the UK. Customer data is held in AWS London. EU residency available. US not offered.

Question 7

How do I know the audit trail can't be edited?

Accepted Answer

Every audit event references the cryptographic hash of the previous event. Change one, every hash after it breaks. We pin the chain to write-locked storage daily.

Question 8

How common are data complaints to the UK regulator?

Accepted Answer

Data complaints are common and rising. The ICO — the UK data regulator — handled 42,881 data-protection complaints in a year, up about 8% on the 39,721 the year before. It also receives over 44,400 nuisance-call reports and nearly 29,000 spam-email reports a year.