In June 2025, the Data (Use and Access) Act (DUAA) received Royal Assent. The DUAA introduced several amendments to existing data protection laws, including the UK General Data Protection Regulation 2016 (UK GDPR), the Data Protection Act 2018 (DPA), and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR).
According to the UK Government’s official website, the Act’s provisions are being implemented in stages. Please refer to our August 2025 Newsletter Article for a complete list of the amendments.
The final provisions on handling data protection complaints will take effect 12 months after the Royal Assent, meaning 19 June 2026.
Article 103 DUAA amends section 164A of the DPA and introduces a new obligation for companies to:
- Inform data subjects, at the time of data collection, of their right to lodge a complaint directly with the company; and
- Provide a mechanism for submitting data protection complaints to the company. This includes:
* give people a clear way to raise a data protection complaint;
* acknowledge it within 30 days of receipt;
* without undue delay, take appropriate steps to investigate and keep people informed; and
* tell the complainant of the outcome.
Companies will therefore be required to establish an internal complaint-handling procedure for dealing with data protection complaints as well as keep a record of the complaints received as it might be required by the Information Commissioner´s Officer (ICO).
More details can be found on the website of the ICO.
At ePrivacy GmbH, we can support your organization with complying with the changes introduced by the DUAA and keep you abreast of ongoing development in the UK.