England and Wales commercial and regulatory procedures
When must a controller acknowledge a data protection complaint?
Thirty days beginning when the complaint is received. Acknowledge receipt, then investigate and communicate the outcome without undue delay. This is a complaint about UK GDPR or Part 3 compliance. It differs from the one-month rights-request response and does not set a 30-day final complaint outcome. SI 2026/82 regulation 7 applies the acknowledgement and handling duties only to complaints received on or after June 19, 2026.
- Period
- Thirty days beginning when the complaint is received
- Trigger
- Receipt of the qualifying data protection complaint
- Rule
- Data Protection Act 2018, section 164A(1) to (5)
Data Protection Act 2018, section 164A(1) to (5). The retained source governs acknowledge receipt, then investigate and communicate the outcome without undue delay. This is a complaint about UK GDPR or Part 3 compliance. It differs from the one-month rights-request response and does not set a 30-day final complaint outcome. SI 2026/82 regulation 7 applies the acknowledgement and handling duties only to complaints received on or after June 19, 2026.
Source guide · No automated date
Check the applicable procedure
This is a complaint about UK GDPR or Part 3 compliance. It differs from the one-month rights-request response and does not set a 30-day final complaint outcome. SI 2026/82 regulation 7 applies the acknowledgement and handling duties only to complaints received on or after June 19, 2026. Retain the statute’s beginning-when-received wording. Do not substitute a later internal allocation or read the acknowledgement period as a final-resolution limit. The actual receipt of the qualifying data protection complaint and required completion must be established before using a final date.
Data Protection Act 2018, section 164A(1) to (5)What lawyers say
5.0“The platform is really easy to use.”
Michael B.Employment litigation attorney · California
“The Evidence Record saved us time with our insurance on bankruptcy matters.”
MariaBankruptcy and commercial attorney · London, UK
“The most up-to-date service we could find.”
Li ChenArbitration practitioner · Singapore
When must a controller acknowledge a data protection complaint?
Thirty days beginning when the complaint is received. Acknowledge receipt, then investigate and communicate the outcome without undue delay. This is a complaint about UK GDPR or Part 3 compliance. It differs from the one-month rights-request response and does not set a 30-day final complaint outcome. SI 2026/82 regulation 7 applies the acknowledgement and handling duties only to complaints received on or after June 19, 2026.
Responsible actor. Controller receiving a section 164A complaint.
Receipt of the qualifying data protection complaint.
This is a complaint about UK GDPR or Part 3 compliance. It differs from the one-month rights-request response and does not set a 30-day final complaint outcome. SI 2026/82 regulation 7 applies the acknowledgement and handling duties only to complaints received on or after June 19, 2026.
This is a complaint about UK GDPR or Part 3 compliance. It differs from the one-month rights-request response and does not set a 30-day final complaint outcome. SI 2026/82 regulation 7 applies the acknowledgement and handling duties only to complaints received on or after June 19, 2026.
Data Protection Act 2018, section 164A(1) to (5)How does this provision count time?
- Acknowledge receipt, then investigate and communicate the outcome without undue delay.
- Retain the statute’s beginning-when-received wording. Do not substitute a later internal allocation or read the acknowledgement period as a final-resolution limit.
- This is a complaint about UK GDPR or Part 3 compliance. It differs from the one-month rights-request response and does not set a 30-day final complaint outcome. SI 2026/82 regulation 7 applies the acknowledgement and handling duties only to complaints received on or after June 19, 2026.
Retain the statute’s beginning-when-received wording. Do not substitute a later internal allocation or read the acknowledgement period as a final-resolution limit.
Retain the statute’s beginning-when-received wording. Do not substitute a later internal allocation or read the acknowledgement period as a final-resolution limit. This is a complaint about UK GDPR or Part 3 compliance. It differs from the one-month rights-request response and does not set a 30-day final complaint outcome. SI 2026/82 regulation 7 applies the acknowledgement and handling duties only to complaints received on or after June 19, 2026.
Data Protection Act 2018, section 164A(1) to (5)Which facts prevent one automatic date?
This is a complaint about UK GDPR or Part 3 compliance. It differs from the one-month rights-request response and does not set a 30-day final complaint outcome. SI 2026/82 regulation 7 applies the acknowledgement and handling duties only to complaints received on or after June 19, 2026. Retain the statute’s beginning-when-received wording. Do not substitute a later internal allocation or read the acknowledgement period as a final-resolution limit. The actual receipt of the qualifying data protection complaint and required completion must be established before using a final date.
The controller receiving a section 164A complaint has established the applicable procedure and receipt of the qualifying data protection complaint. This is a complaint about UK GDPR or Part 3 compliance. It differs from the one-month rights-request response and does not set a 30-day final complaint outcome. SI 2026/82 regulation 7 applies the acknowledgement and handling duties only to complaints received on or after June 19, 2026. Acknowledge receipt, then investigate and communicate the outcome without undue delay. Thirty days beginning when the complaint is received. No computed final date is supplied.
A proposed completion raises a nonbusiness-day or time-boundary question for acknowledge receipt, then investigate and communicate the outcome without undue delay. Retain the statute’s beginning-when-received wording. Do not substitute a later internal allocation or read the acknowledgement period as a final-resolution limit. Resolve this boundary under the identified provision and actual completion route. Retain the statute’s beginning-when-received wording. Do not substitute a later internal allocation or read the acknowledgement period as a final-resolution limit.
The controller received the complaint before June 19, 2026, but considers it after that date. This is a complaint about UK GDPR or Part 3 compliance. It differs from the one-month rights-request response and does not set a 30-day final complaint outcome. SI 2026/82 regulation 7 applies the acknowledgement and handling duties only to complaints received on or after June 19, 2026. This is a complaint about UK GDPR or Part 3 compliance. It differs from the one-month rights-request response and does not set a 30-day final complaint outcome. SI 2026/82 regulation 7 applies the acknowledgement and handling duties only to complaints received on or after June 19, 2026. No automatic final date follows from this scenario.
Which conditions and exceptions apply?
- Applicable procedure and actual event
- This is a complaint about UK GDPR or Part 3 compliance. It differs from the one-month rights-request response and does not set a 30-day final complaint outcome. SI 2026/82 regulation 7 applies the acknowledgement and handling duties only to complaints received on or after June 19, 2026.
- Counting and completion boundary
- Retain the statute’s beginning-when-received wording. Do not substitute a later internal allocation or read the acknowledgement period as a final-resolution limit.
- This is a complaint about UK GDPR or Part 3 compliance. It differs from the one-month rights-request response and does not set a 30-day final complaint outcome. SI 2026/82 regulation 7 applies the acknowledgement and handling duties only to complaints received on or after June 19, 2026.
- Controller receiving a section 164A complaint. Receipt of the qualifying data protection complaint. Acknowledge receipt, then investigate and communicate the outcome without undue delay. Retain the statute’s beginning-when-received wording. Do not substitute a later internal allocation or read the acknowledgement period as a final-resolution limit.
What must the responsible actor complete?
Questions about this procedure
When must a controller acknowledge a data protection complaint?
Does the new duty cover complaints received before June 19, 2026?
SI 2026/82 regulation 7 applies section 164A(3) and (4) only to complaints received on or after June 19, 2026.
Data Protection Act 2018, section 164A(1) to (5)Does every customer-service complaint qualify?
Section 164A(1) concerns an alleged infringement involving the data subject’s personal data.
Data Protection Act 2018, section 164A(1) to (5)Is this the same deadline as a subject access request?
No. The request and complaint have distinct statutory duties.
Data Protection Act 2018, section 164A(1) to (5)Does the controller need to facilitate complaints?
Yes. Subsection 2 requires suitable steps, including possible electronic complaint forms.
Data Protection Act 2018, section 164A(1) to (5)Can internal forwarding restart the period?
The statutory event is receipt of the complaint by the controller.
Data Protection Act 2018, section 164A(1) to (5)What must appropriate response steps include?
Subsection 5 includes appropriate enquiries and progress information.
Data Protection Act 2018, section 164A(1) to (5)Official sources and review
Provisions used (2)
| Provision | Purpose |
|---|---|
| Data Protection Act 2018, section 164A(1) to (5) | Check the identified procedure, event, counting rule or qualification |
| The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, regulation 3(a) and regulation 7 | Check the identified procedure, event, counting rule or qualification |