UK Data Protection Complaints Are Now Law: Build a Complaint Record in Your CRM

Since June 2026, organizations in the United Kingdom have a legal duty to handle data protection complaints. You must give people a clear way to complain, acknowledge each complaint, investigate it and tell the person the outcome. If you hold customer records for UK contacts, your CRM is the natural place to prove you did this.

This post covers what the Information Commissioner's Office (ICO) says, and then gives you a simple complaint record you can build in an afternoon. Owners in the United States, Australia and Canada can use the same record, because a complaint log is good practice anywhere.

What changed and who it covers

The duty comes from the Data (Use and Access) Act 2025. The ICO published its final guidance in February 2026. On 23 June 2026 it announced that the new complaints requirements were in force, after the Act's 12-month commencement point on 19 June.

The duty applies to organizations of every size. The ICO says you can fold data protection complaints into the complaints process you already have. You do not need a separate system, but you must be able to meet each duty.

The ICO lists four core duties:

• Give people a clear way to raise a data protection complaint.
• Acknowledge each complaint within 30 days.
• Investigate it appropriately and without unjustifiable delay.
• Tell the person the outcome.

The 30 day clock is shorter than it looks

The 30 days start the day after you receive the complaint. Weekends and public holidays count. If the final day lands on a weekend or public holiday, you have until the next working day.

The clock covers only the acknowledgement. Your duty to investigate begins on receipt. The ICO sets no fixed deadline for the full answer, but any internal target you set must not cause unjustifiable or excessive delay.

A complaint can also arrive in any channel. It may come by email, live chat, post, phone, in person or through social media. It may land with any staff member, not just the owner. That is where most small teams lose track of it.

Build a complaint record in your CRM

Treat a data protection complaint as its own record type, linked to the contact. Do not bury it in a general note. A tagged record lets you search, report and show your work later.

Fields to add

1. Date received. This starts your clock, so enter it the day the complaint arrives.
2. Channel. Email, chat, post, phone, in person or social media.
3. Received by. The staff member who first saw it.
4. Summary. One or two plain sentences about what the person is unhappy with.
5. Acknowledgement sent. Date, method and a copy of the message.
6. Acknowledgement due date. Have the CRM calculate this from the received date, and move it to the next working day if it falls on a weekend or holiday.
7. Owner. One named person responsible for the case.
8. Status. Received, acknowledged, investigating, outcome sent, closed.
9. Outcome and actions. What you decided and what you changed as a result.

These fields match what the ICO says to keep: the receipt date, your acknowledgement, relevant conversations and documents, the outcome and any actions taken. Store the documents as attachments on the same record.

Set up the workflow

Records only help if the work moves. Add three simple rules.

• Auto-acknowledge electronic complaints. The ICO says an automatic reply is fine for email and live chat. Log the date it went out.
• Alert the owner before the due date. Set a reminder a few days ahead of the acknowledgement date, so a holiday or sick day does not cause a miss. The ICO suggests arranging cover for predictable absences.
• Escalate stalled cases. If a case sits in the investigating status with no update, flag it to the owner. The ICO expects you to keep the person informed, explain delays and, where you can, give an expected completion date.

Handle each channel properly

For a phone or in-person complaint, the ICO says to acknowledge it verbally by summarizing the complaint, confirming the contact method and giving a reference number if you use one. Then confirm in writing. Add a short script for this to your team notes.

For a complaint sent through social media, reply and ask the person to use a more secure contact method. The ICO notes that social media is not secure for personal information. Log the original message and your reply on the record.

Make the route easy to find

The ICO says people need a clear way to complain, and that you should tell them how in your privacy notice. Add a short line and a dedicated email address or web form there. Point your CRM form or inbox rule to the same place, so every message creates a record.

Train everyone who talks to customers. The rule is simple: if someone says they are unhappy about how you use their personal data, create a record the same day. Do not wait to decide whether it counts as a formal complaint.

Connect complaints to your consent and opt-out records

Many data protection complaints start with marketing. A person gets a message after they opted out, or cannot tell where you found their details. Link each complaint to the contact's consent and opt-out history, so the investigator can see what you recorded and when.

If the complaint is valid, fix the cause and not just the single record. Check whether the same suppression gap affects other contacts. Write the fix in the actions field, so the record shows what you changed.

Review complaints every quarter

The ICO says complaint volumes and recurring themes can reveal compliance problems, and it will use trends to decide where to step in. You can do the same on a small scale. Once a quarter, filter your complaint records and look for repeats.

• Which channel brings the most complaints?
• Do many mention the same form, campaign or staff process?
• How many were acknowledged on time?
• How long did cases stay open?

Pick one change from the review, such as a clearer sign-up form or a faster opt-out step. Then record it as an action.

Keep the record lean

The complaint record holds personal information, so apply your retention rules to it. The ICO says not to keep personal information longer than needed. Set a review date on each closed case and delete or anonymize details once the purpose has ended. Keep only summary counts for your quarterly review.

A short checklist

1. Add a data protection complaint record type to your CRM.
2. Add the nine fields above, with an automatic due date.
3. Set up auto-acknowledgement for email and chat.
4. Publish the complaint route in your privacy notice.
5. Train all staff to log a complaint the day they hear it.
6. Link each complaint to consent and opt-out history.
7. Review themes quarterly and set a deletion date for closed cases.

Check the ICO's current guidance for the full detail, since it may be updated. A clear record, a named owner and a reminder rule will cover most of what a small team needs.