Procedural guides on UK data protection obligations — what each duty requires, how to tell them apart, and how to handle the edge cases.
A subject access request and a data protection complaint arrive the same way and are constantly confused — but they sit under different law and run on different clocks. This guide gives you a one-line test to tell them apart, a side-by-side comparison, and how to handle a message that is both.
From 19 June 2026 you must acknowledge a data protection complaint within 30 days of receipt. This guide walks through the steps: confirm it is a complaint, record the receipt date, acknowledge early, say the right things, and keep the evidence.
Not every message about data is a data protection complaint that starts the 30-day clock. This guide draws the line between a complaint, a general query, and a subject access request — and how to handle the grey cases.
The 30-day deadline to acknowledge a data protection complaint counts calendar days, not working days. Weekends and bank holidays do not extend it. Here is how to count correctly and where the trap is.