If you work in finance, legal services, banking, or healthcare in the UK, you have 20 days to implement a legally mandated data protection complaints process — or face regulatory scrutiny from the Information Commissioner's Office (ICO).

From 19 June 2026, all UK organisations acting as data controllers must have a formal, accessible complaints process in place under the Data (Use and Access) Act 2025 (DUAA). This is not optional. There are no exemptions — not for size, sector, or existing GDPR compliance frameworks.

The ICO confirmed on 19 May 2026 that sectors where data protection complaints are most common include healthcare, financial services, technology and retail — placing your organisation squarely in the crosshairs of this new enforcement regime.

The DUAA 2025 introduces a statutory right for individuals (data subjects) to complain directly to a data controller if they believe their personal data has been processed in breach of UK data protection law. While organisations have always had to deal with data protection concerns in practice, from 19 June 2026 this becomes a formal legal requirement with specific procedural obligations.

This represents a fundamental shift from the previous regime, where individuals were primarily directed to complain to the ICO. Now, your organisation is the first port of call — and you must be ready.

According to the ICO's official guidance published in February 2026, organisations must:

• Provide a clear way for individuals to raise a data protection complaint (online form, email, phone, or live chat — the format is flexible, but it must exist)
• Acknowledge the complaint within 30 days of receipt (including weekends and public holidays)
• Investigate without undue delay and keep the complainant informed of progress
• Communicate the outcome clearly, including the individual's right to escalate to the ICO if dissatisfied

For professionals in finance, legal, banking, and healthcare, the stakes are particularly high. These sectors handle some of the most sensitive personal data in the UK economy — from patient medical records and financial transaction histories to legal privilege documents and credit assessments.

Financial Services & Banking

Banks and financial institutions process vast quantities of personal data daily. Under the DUAA complaints regime, a customer who believes their data was misused in a credit decision, shared without consent, or inadequately protected following a breach now has a direct, legally enforceable route to complain to you first.

The FCA's own operational resilience framework (PS26/2) already requires firms to demonstrate robust incident and complaint-handling capabilities. The DUAA complaints process adds another layer — and the two frameworks must work in harmony.

Key risk: Failure to acknowledge a complaint within 30 days could trigger ICO investigation, even if the underlying data processing was lawful.

Legal Services

Law firms hold highly sensitive client data, including privileged communications, financial records, and personal identification documents. Many firms already have client complaint procedures under SRA requirements — but these may not meet the specific DUAA data protection complaints standard.

Key risk: A client who raises a concern about how their personal data was handled during a matter may trigger the DUAA complaints process, even if the communication is framed as a general service complaint.

Healthcare

The NHS and private healthcare providers are among the highest-volume handlers of special category personal data in the UK. Patient data complaints are already common — but the DUAA formalises the process and creates a documented compliance trail that the ICO can audit.

Key risk: Healthcare organisations that fail to update their privacy notices and patient-facing communications to reflect the new right to complain directly to the controller will be non-compliant from day one.

Data protection complaints are not limited to digital data. Under UK GDPR and the DUAA, personal data includes any information held in any format — including paper records, physical files, and documents awaiting destruction.

If a patient, client, or customer complains that their physical records were not securely destroyed, or that confidential documents were disposed of improperly, this falls squarely within the new complaints regime.

For regulated industries, this means your secure document shredding and destruction processes must be part of your data protection complaints framework. Specifically:

• Certificates of Destruction from accredited shredding providers serve as evidence of compliant disposal — critical documentation if a complaint is raised about physical data handling
• Retention schedules must be clearly documented and communicated, so individuals understand how long their physical records are held
• Processor agreements with shredding providers must include obligations to assist with complaint investigations and provide records of destruction on request

The ICO's guidance makes clear that organisations must review their processor agreements to ensure appropriate cooperation obligations are included — this explicitly covers third-party data destruction providers.

With the 19 June 2026 deadline approaching, here is what regulated industry professionals must do immediately:

✅ Week 1 (By 6 June 2026)

• Audit existing complaint channels — identify all routes through which data protection complaints could arrive (email, phone, web form, in-person, via processors)
• Designate a complaints handler — assign responsibility for data protection complaints to a named individual or team (DPO, compliance officer, or equivalent)
• Review processor agreements — check contracts with all data processors, including IT providers, cloud services, and document shredding companies, for complaint cooperation obligations

✅ Week 2 (By 13 June 2026)

• Update privacy notices — add clear language about the individual's right to complain directly to your organisation, with contact details
• Update DSAR response templates — include information about the right to raise a data protection complaint
• Draft or update your written complaints procedure — document the process, even if not mandatory, to demonstrate compliance to the ICO
• Train frontline staff — ensure employees can recognise a data protection complaint and know how to escalate it

✅ Final Days (By 18 June 2026)

• Test your complaints intake process — submit a test complaint through each channel to verify acknowledgement within 30 days is achievable
• Implement complaint tracking — set up a log to record receipt date, acknowledgement date, investigation steps, outcome, and any remedial actions
• Brief senior management and DPO — ensure governance and escalation pathways are clear

The ICO has been clear: it is "not here to catch businesses out" — but it will act where organisations demonstrate systemic non-compliance. For regulated industries already under heightened scrutiny from sector-specific regulators (FCA, PRA, CQC, SRA), an ICO investigation triggered by a missed DUAA complaints deadline could have cascading consequences.

Potential outcomes include:

• Formal ICO investigation triggered by a complainant who escalates to the regulator after receiving no response
• Enforcement notices requiring immediate remediation
• Reputational damage in sectors where client and patient trust is paramount
• Regulatory cross-referral — the ICO may share findings with the FCA, CQC, or SRA where sector-specific obligations are also implicated

1. ICO Official Guidance — How to Deal with Data Protection Complaints: ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/ — The definitive must, should, and could framework from the regulator itself.

2. Sidley Austin Data Matters Blog — Preparing for the UK's New Data Protection Complaints Regime: datamatters.sidley.com — Detailed legal analysis including FAQs on what counts as a complaint and processor obligations.

3. Womble Bond Dickinson — Data Protection Complaints: Are You Ready?: womblebonddickinson.com — Practical sector guidance on updating privacy notices, DSAR templates, and processor contracts.

At Venture Waste, we provide BS EN 15713-accredited confidential document shredding and secure data destruction services for regulated industries across the UK. Our services directly support your DUAA compliance obligations:

• Certificates of Destruction provided for every shredding job — essential evidence for your data protection complaints records
• Processor agreements that include complaint cooperation obligations, fully aligned with DUAA requirements
• Scheduled and on-demand shredding for finance, legal, banking, and healthcare organisations
• Audit trails that demonstrate compliant physical data disposal — critical if a complaint is raised about document handling

With 20 days until the ICO deadline, now is the time to ensure your physical data destruction processes are as robust as your digital compliance framework.

Contact Venture Waste today to review your document destruction compliance ahead of 19 June 2026.

Published: 30 May 2026 | Author: Venture Waste Compliance Team | Keywords: data protection complaints, DUAA 2026, ICO deadline June 2026, data compliance, GDPR complaints process, document shredding compliance, UK regulated industries