Individuals will be expected to raise complaints directly with organisations first, before escalating issues to the ICO.
For most businesses, this is primarily a legal and operational change — but it has direct implications for your website, which is very often the first point of contact for exactly this kind of complaint.
What’s Actually Changing
Complaints must be accepted regardless of how they are submitted, including via social media. Controllers must ensure individuals are informed of their right to complain in privacy notices and when responding to requests to exercise data protection rights.
As a general principle, substantive engagement on social media should be avoided. Instead, individuals should be directed to a secure and appropriate complaints channel.
| Before 19 June 2026 | From 19 June 2026 |
|---|---|
| No express legal duty to provide an internal complaints process | Statutory duty to operate an internal complaints handling process |
| Privacy notices not required to mention complaint rights | Privacy notices must inform individuals of their right to complain |
| Complaints often handled informally or inconsistently | Acknowledgement required within 30 days, with investigation beginning immediately |
| Complaints could be missed if raised informally | Complaints must be accepted regardless of channel, including social media |
| No requirement to direct individuals to a clear channel | Individuals should be directed to a secure, defined complaints channel |
Why This Is A Website Issue, Not Just A Legal One
Your website is usually where someone first looks when they want to raise a concern about how their data has been handled. That makes a few things relevant to anyone managing a site, not just your legal team.
Your privacy notice needs updating.
It must now clearly explain how someone can complain directly to you, not just reference their right to go to the ICO. This is a content change your web team needs to action before 19th June.
You need a clear, findable complaints channel.
A buried contact form or generic “get in touch” page isn’t sufficient if it doesn’t clearly signpost data protection complaints specifically. Complaints may be raised through any channel, not just designated forms, which means your forms, chatbots, and contact pages all need a route for these to be properly identified and routed.
Your tracking and consent setup feeds into this.
Many data protection complaints originate from concerns about tracking, cookies, and how personal data is collected on-site. If your Google Tag Manager governance and consent mode setup aren’t clean and compliant, you’re more exposed to the kind of complaints this new regime is designed to surface and resolve quickly.
Verification processes need to exist for third-party complaints.
In the case of complaints submitted by third parties on behalf of data subjects, organisations must verify that the third party is authorised to act before investigating the complaint. If you’re collecting data through forms on your site, your process needs to account for this.
What To Do Before 19 June
Review your privacy notice and contact pages now — this is the quickest fix and the easiest one to miss. Audit your site’s data collection points using a structured SEO audit lens that includes tracking and consent compliance alongside technical performance. And make sure your data and analytics infrastructure is clean enough that you can answer specific questions about what data you collect and why, since that’s exactly what a thorough complaint will ask you to demonstrate.
FAQs
Does this apply to small businesses?
Yes — every data controller must have an internal process for handling data protection complaints, with no exemptions.
Is there a deadline for responding to complaints?
There’s no strict statutory deadline for investigations, but organisations must exercise reasonable judgement and be able to justify their approach, with acknowledgement expected within 30 days.
Get Your Website Compliance-Ready
If your site’s privacy notice, contact channels, or tracking setup need a review ahead of 19th June, the team at Totally Digital can help you get it sorted before the deadline.