ICO Consultation on Data Protection Complaint Handling

The Information Commissioner’s Office (ICO) is currently consulting on proposed changes to its framework for handling data protection complaints. There is a statutory right to lodge a complaint with the ICO if an individual thinks that their rights under the data protection legislation have been infringed.

1. Rising Complaints and Resource Constraints: The ICO has observed a significant increase in data protection complaints, with numbers rising from 39,721 in 2023/24 to 42,881 in 2024/25. Projections suggest this could reach between 45,000 and 55,000 if current trends persist. This increase is affecting the ICO’s ability to respond to complaints quickly and effectively.
2. Proposed Framework: The ICO is proposing a new framework to assess and determine the appropriateness of investigating each complaint. This aims to focus resources on cases where the ICO can have the most impact, thereby improving data protection compliance.
3. Impact of the Data (Use and Access) Act 2025 (DUAA): The DUAA introduces new requirements for organisations to have a dedicated complaints process for data protection issues. This is expected to resolve more complaints at the organisational level, reducing the need for ICO intervention.
4. Strategic Regulatory Approach: The proposed changes reflect the ICO’s ambition to be a strategic regulator. The new approach would ensure that every complaint contributes to understanding an organisation’s information rights practices, while focusing resources on significant risks and identifying systemic issues earlier.
5. Monitoring and Reporting: The ICO plans to implement new reporting mechanisms to monitor complaint volumes across organisations and sectors. This will help identify trends or themes that may require regulatory action.

Whatever the outcome of the ICO consultation, it is obviously in an organisation’s interest to minimise the risk of complaints. That means not only putting in appropriate measures to secure the personal information that you hold, but making it clear to people what you do with that information. We can help with preparing or reviewing privacy policies.

To respond to the consultation, go to this link. If you have any questions regarding the contents of this article, please contact our Commercial law team here. 

The contents of this article is a general guide only at the date of publication. It is not comprehensive, and it does not constitute legal advice. Specific legal advice should be sought in relation to the particular facts of a given situation.