A data subject who considers there is an infringement of the UK GDPR or Part 3 in connection with their data may complain to the controller. The controller must facilitate complaints, for example with a complaint form that can be completed electronically and by other means, acknowledge each complaint within 30 days of receipt, and without undue delay take appropriate steps to respond (including enquiries into the subject matter, to the extent appropriate, and keeping the complainant informed of progress) and tell the complainant the outcome. The duties apply to complaints received on or after 19 June 2026. Section 164B lets regulations require controllers to report the number of complaints to the Commissioner; none are recorded in the text. Breach is an enforcement failure with the standard maximum penalty.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.