The Information Commissioner’s Office (ICO) is consulting on draft changes to how they handle data protection complaints. It sets out the proposed framework to assess and determine the extent to which it is appropriate to investigate each complaint. This will allow the ICO to focus on cases where they can have the most impact and improve data protection compliance.
In recent years there has been a significant increase in data protection complaints. In 2023/24, the ICO received 39,721 complaints. In 2024/25 this rose to 42,881 and current forecasts indicate that this could increase to somewhere between 45,000 and 55,000 if the current trend continues.
The Data (Use and Access) Act (DUAA) places new requirements on organisations to have a complaints process specifically for data protection related issues. Once the provision comes into force, the ICO would expect that more complaints will be resolved by organisations without the involvement of the ICO.
The ICO has developed a draft framework that they propose to use to determine the extent to which it is appropriate to investigate each complaint. They are also proposing new reporting mechanisms to enable them to monitor complaint volumes across specific organisations and sectors.
The consultation will remain open until Friday 31 October 2025.
This provides summary information and comment on the subject areas covered. Where employment tribunal and appellate court cases are reported, the information does not set out all of the facts, the legal arguments presented and the judgments made in every aspect of the case. Employment law is subject to constant change either by statute or by interpretation by the courts. While every care has been taken in compiling this information, we cannot be held responsible for any errors or omissions. Specialist legal advice must be taken on any legal issues that may arise before embarking upon any formal course of action.
