Data Protection Act 2018

Complaints U.K.

[F1 164A Complaints by data subjects to controllers U.K.

(1) A data subject may make a complaint to the controller if the data subject considers that, in connection with personal data relating to the data subject, there is an infringement of the UK GDPR or Part 3 of this Act.

(2) A controller must facilitate the making of complaints under this section by taking steps such as providing a complaint form which can be completed electronically and by other means.

(3) If a controller receives a complaint under this section, the controller must acknowledge receipt of the complaint within the period of 30 days beginning when the complaint is received.

(4) If a controller receives a complaint under this section, the controller must without undue delay—

(a) take appropriate steps to respond to the complaint, and

(b) inform the complainant of the outcome of the complaint.

(5) The reference in subsection (4)(a) to taking appropriate steps to respond to the complaint includes—

(a) making enquiries into the subject matter of the complaint, to the extent appropriate, and

(b) informing the complainant about progress on the complaint.

Textual Amendments

F1 Ss. 164A, 164B inserted (19.6.2025 for specified purposes, 19.6.2026 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 103(2), 142(1)(2)(h); S.I. 2026/82, reg. 3(a) (with reg. 7)

164B Controllers to notify the Commissioner of the number of complaints U.K.

(1) The Secretary of State may by regulations require a controller to notify the Commissioner of the number of complaints made to the controller under section 164A in periods specified or described in the regulations.

(2) Regulations under this section may provide that a controller is required to make a notification to the Commissioner in respect of a period only in circumstances specified in the regulations.

(3) Regulations under this section may include—

(a) provision about a matter listed in subsection (4), or

(b) provision conferring power on the Commissioner to determine those matters.

(4) The matters are—

(a) the form and manner in which a notification must be made,

(b) the time at which, or period within which, a notification must be made, and

(c) how the number of complaints made to a controller during a period is to be calculated.

(5) Regulations under this section are subject to the negative resolution procedure.]

Textual Amendments

F1 Ss. 164A, 164B inserted (19.6.2025 for specified purposes, 19.6.2026 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 103(2), 142(1)(2)(h); S.I. 2026/82, reg. 3(a) (with reg. 7)

165 Complaints by data subjects [F2 to the Commissioner] U.K.

F3 (1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(2) A data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of [F4 the UK GDPR or] Part 3 or 4 of this Act.

(3) The Commissioner must facilitate the making of complaints under subsection (2) by taking steps such as providing a complaint form which can be completed electronically and by other means.

(4) If the Commissioner receives a complaint under subsection (2), the Commissioner must—

(a) take appropriate steps to respond to the complaint,

(b) inform the complainant of the outcome of the complaint,

(c) inform the complainant of the rights under section 166, and

(d) if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.

(5) The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes—

(a) investigating the subject matter of the complaint, to the extent appropriate, and

(b) informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with [F5 a] foreign designated authority is necessary.

F6 (6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(7) In this section—

• “foreign designated authority” means an authority designated for the purposes of Article 13 of the Data Protection Convention by a party, other than the United Kingdom, which is bound by that Convention;

• F7 ...

Textual Amendments

F2 Words in s. 165 heading inserted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 19; S.I. 2026/82, reg. 3(b) (with reg. 7)

F3 S. 165(1) omitted (19.6.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 103(3)(a), 142(1); S.I. 2026/82, reg. 3(a) (with reg. 7)

F4 Words in s. 165(2) inserted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 103(3)(b), 142(1); S.I. 2026/82, reg. 3(a) (with reg. 7)

F5 Word in s. 165(5)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 66(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F6 S. 165(6) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 66(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F7 Words in s. 165(7) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 66(5) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement Information

I1 S. 165 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

166 Orders to progress complaints [F8 to the Commissioner] U.K.

(1) This section applies where, after a data subject makes a complaint under section 165 F9 ..., the Commissioner—

(a) fails to take appropriate steps to respond to the complaint,

(b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or

(c) if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.

(2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner—

(a) to take appropriate steps to respond to the complaint, or

(b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.

(3) An order under subsection (2)(a) may require the Commissioner—

(a) to take steps specified in the order;

(b) to conclude an investigation, or take a specified step, within a period specified in the order.

(4) Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it applies for the purposes of section 165(4)(a).

Textual Amendments

F8 Words in s. 166 heading inserted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 20(2); S.I. 2026/82, reg. 3(b) (with reg. 7)

F9 Words in s. 166(1) omitted (19.6.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 20(3); S.I. 2026/82, reg. 3(b) (with reg. 7)

Commencement Information

I2 S. 166 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)