For founders and small teams · under 50 staff
Data-protection duties, sorted — without hiring anyone.
You run the business. You don't have a compliance department. The 30-day complaint duty still applies to you. TheDutyDesk handles it — set up in 30 minutes, from £19.99/month.
From £199 a year · lock in launch pricing · no card to join.
Does this actually apply to me?
Yes. Section 164A of the Data Protection Act 2018 applies to every UK data controller — a sole trader, a four-person studio, a 40-person agency — with no size threshold and no revenue floor. If you hold customer details, employee records, or supplier contacts, you hold the duty.
"Facilitate" is an active obligation. You must provide a named, accessible route for data-protection complaints — not just a general contact form. The ICO's enforcement attention skews toward serious cases, but a single unhandled complaint is enough to open one.[2]
What you actually have to do.
Four obligations. All of them strict.[2]
01
Let people complain.
Provide a named, signposted channel for data-protection complaints — on your website, in your privacy notice, and on every channel you use to communicate with customers.
02
Acknowledge within 30 days.
Once you receive the complaint, acknowledge it within one month. A generic auto-responder does not count. The clock starts from the moment the complaint reaches your organisation.[2]
03
Respond without undue delay.
Investigate and communicate the outcome. No hard deadline after acknowledgement, but you must move at a reasonable pace and keep a record of your progress.[2]
04
Keep evidence the regulator can review.
An auditable record of every complaint — what arrived, when, what you said, what you decided. The ICO can ask for it at any time. You cannot charge for this.[2]
Why an inbox won't cut it.
Most small businesses handle complaints — or assume they do — via a shared email inbox. Email has three gaps the duty requires you to close.[4]
| What the duty requires | What email gives you |
|---|---|
| 30-day clock, per complaint | Timestamps on individual emails — no countdown, no owner |
| Tamper-evident audit trail | A folder of emails that can be recalled, deleted, or lost |
| One-click ICO evidence pack | A day rebuilding threads and screenshots into something usable |
When a complaint lands, it's handled — and you can prove it.
The ICO has real enforcement powers — a maximum penalty of £17.5 million or 4% of worldwide annual turnover, whichever is higher[3] — and issued 28 penalty notices in 2025, totalling approximately £19.6 million.[9]
For most small businesses, the realistic risk is different.
The realistic small-business risk is not a headline fine. It's an ICO information notice you cannot answer — demanding the full complaint file, the acknowledgement timestamp, the audit trail. If you can't produce it, you face a formal investigation. The cost there is your time, your legal fees, and your defensibility. TheDutyDesk makes that file appear in one click.
Set up before lunch.
No IT department. No procurement. No sales call.
Embed the complaint form.
Two lines of HTML, or link directly. Works on any website, any page.
Set the acknowledgement template.
Configure the 30-day auto-acknowledgement once. It sends the right message every time, and starts the audit trail automatically.
Done.
Every complaint that arrives from here starts a clock, creates an audit entry, and queues a one-click evidence pack the moment you need it.
What it costs.
Two tiers for organisations under 250 staff. Full pricing table →
Starter
£19.99 / month
Under 10 staff · 1 user · 50 complaints / yr
- ✓ Hosted complaint form + embeddable widget
- ✓ 30-day clock and auto-acknowledgement
- ✓ Immutable audit trail
- ✓ One-click ICO evidence pack
- ✓ UK data residency
14-day trial · no card to start · cancel anytime
SME
£49.99 / month
10–250 staff · 3 users · unlimited complaints
- ✓ Everything in Starter
- ✓ 3 user accounts
- ✓ Unlimited complaint volume
- ✓ Zendesk + Slack integrations
- ✓ All channels: web, email, social
14-day trial · no card to start · cancel anytime
Save 20% with annual billing. 14-day free trial on both tiers.
From £199 a year · lock in launch pricing · no card to join.
Free PDF · 2 pages
Not ready to decide? Take the checklist.
The eight things every UK small business must have in place for the 30-day complaint duty. Free PDF, no obligation — we'll email it and nothing else unless you ask.