The Information Commissioner's Office (ICO) has announced the entry into force of new legal obligations for all organisations in the United Kingdom regarding the handling of data protection complaints.

Since 23 June 2026, all organisations are required to provide individuals with a clear way to submit a data protection complaint, acknowledge receipt within 30 days, conduct an appropriate investigation, and communicate the outcome. These requirements stem from the Data (Use and Access) Act, all provisions of which came into force on 19 June 2026. To support businesses, the ICO has published guidance including concrete examples on topics such as access requests, inaccuracies in personal data, or marketing. The authority specified that its goal is to embed good practices into the daily operations of businesses to strengthen trust, rather than to sanction, noting that a study revealed that more than two-thirds of affected businesses are unaware that this law applies to them.