Data (Use and Access) Act 2025 s.103: Section 103 and Schedule 10: Complaints by data subjects to controllers (2018 Act section 164A)

Gives data subjects the right to complain to the controller about an infringement of the UK GDPR or Part 3 of the 2018 Act; the controller must facilitate complaints (for example an electronic complaint form), acknowledge within 30 days, respond without undue delay with appropriate enquiries and progress updates, and tell the complainant the outcome; privacy notices and access responses must mention the right to complain; regulations may require controllers to report complaint numbers to the Commissioner. Complaints to the Commissioner move to section 165 of the 2018 Act.