Get aware of the section 164A data protection complaints duty
A new statutory duty under section 164A of the Data Protection Act requires every UK business processing personal data to publish a route for individuals to raise complaints. Get the draft clause to add to your privacy notice, or have us do it for you.
What changed on 19 June 2026
The Data (Use and Access) Act 2025 inserted a new section 164A into the Data Protection Act 2018. Every UK organisation processing personal data now has a statutory duty to operate a data protection complaints process. There are no exemptions for size or sector.
Individuals can no longer go straight to the Information Commissioner's Office (ICO) — they must raise complaints with the organisation first. The ICO redirects anyone who skips this step. Complaint volume to UK businesses is expected to rise.
What you need to publish
A clause in your privacy notice
Setting out the right to raise a data protection complaint directly with your business, and how to do it.
An accessible complaints route
A labelled email address or web form that lets someone raise a complaint without needing to know any legal terminology.
A process for the 30-day acknowledgment
Written confirmation of receipt within 30 days, followed by investigation and outcome communication.
Get the free draft clause
A one-page draft, ready to adapt for your business. Sent by email immediately.
Or have us draft it for your business
We review your existing privacy notice and contact page, draft the section 164A clause specifically for your business, and send placement instructions for your privacy notice, contact form, and patient or customer communications. Turnaround within two working days.
Order the draft serviceWho Priortell is
Priortell builds tools that help UK businesses respond to new regulation before the worse outcome arrives. Priortell Aware is for businesses that need accurate, professional drafts for new statutory duties — without paying solicitor rates for a one-page clause.