What changed
The DUAA controller complaints requirements commenced on 19 June 2026. Facilitate complaints, acknowledge them within 30 days, make appropriate enquiries, keep the person informed and communicate the outcome without undue delay.
Action for your organisation
Publish an accessible complaint route and assign ownership. Test recognition across email, telephone and other contact channels. Add acknowledgement and outcome evidence to the complaint log.
Make the route easy to find
Explain how a person can raise concerns about your handling of their information. Ensure requests arriving through normal contact channels reach the responsible team, and make the process accessible.
Use an acknowledgement and investigation log
Record receipt, acknowledgement, the issues raised, the enquiries made, progress communications and the outcome. The 30-day acknowledgement requirement should not be confused with a universal 30-day resolution deadline.
Test the process with a realistic example
Ask a colleague to route a complaint about an unanswered access request. Check ownership, response language, escalation and links to the rights log. Use the outcome to improve training and the privacy notice.
Put it into practice
Use the relevant topic guide to review the legal conditions, then capture the decision in the working registers. Assign an owner and review the implemented process, not just the wording of the policy.
Official sources
Original explanatory briefing prepared with AI-assisted source comparison. No independent human legal review or regulatory endorsement is claimed.