PART 6

Enforcement

Complaints

Complaints by data subjects to controllers
164A
1
A data subject may make a complaint to the controller if the data subject considers that, in connection with personal data relating to the data subject, there is an infringement of the UK GDPR or Part 3 of this Act.
2
A controller must facilitate the making of complaints under this section by taking steps such as providing a complaint form which can be completed electronically and by other means.
3
If a controller receives a complaint under this section, the controller must acknowledge receipt of the complaint within the period of 30 days beginning when the complaint is received.
4
If a controller receives a complaint under this section, the controller must without undue delay—
a
take appropriate steps to respond to the complaint, and
b
inform the complainant of the outcome of the complaint.
5
The reference in subsection (4)(a) to taking appropriate steps to respond to the complaint includes—
a
making enquiries into the subject matter of the complaint, to the extent appropriate, and
b
informing the complainant about progress on the complaint.
Ss. 164A, 164B inserted (19.6.2025 for specified purposes) by Data (Use and Access) Act 2025 (c. 18), ss. 103(2), 142(1)(2)(h)
Pt. 6 applied in part (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 406 (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g) (with reg. 4))