Adding a Data Protection Complaints Route to Your Website
Since 19 June 2026, every UK organisation that handles personal data has had to give people a way to make data protection complaints directly to it. The rule comes from the Data (Use and Access) Act 2025, and the Information Commissioner's Office is clear that there are no exemptions for size. For a small business, the most visible part of complying is your website: people need to be able to find out how to complain, and the route needs to work. This article covers the web side. It is general information, so if you handle sensitive data or have had complaints already, a data protection adviser or solicitor is worth a call.
What the law now asks of you
The ICO's guide on how to deal with data protection complaints lists four duties. You must:
- give people a way of making data protection complaints to you;
- acknowledge receipt of a complaint within 30 days of receiving it;
- take appropriate steps to respond, including making appropriate enquiries, and keep the person informed, without undue delay;
- tell the person the outcome of their complaint without undue delay.
The ICO's page on what the Act means for organisations places this within a wider set of changes. For a typical small firm, the complaints duty is the one most likely to need a visible change on the website.
Where the route should appear
A complaints route that exists only in a staff handbook does not help the customer. Put it where people look:
- Your privacy notice. This is the natural home. Add a short section titled something like "If you are unhappy with how we have used your information".
- Your contact page. A one-line link to the privacy complaints section is enough. People who are annoyed tend to go straight to Contact.
- Forms that collect personal data. The text near a newsletter sign-up or enquiry form usually links to the privacy notice already. Check the link works and lands on the right section.
- Your footer. If the privacy notice is linked from every page footer, you have covered most of the site in one go. Our guest piece on organising footer links around reader questions is a good prompt for tidying that area at the same time.
Wording that works
Lawyers can draft the formal part, but the section people read should be short and human. Something along these lines covers the essentials:
If you are unhappy with how we have collected or used your personal information, please tell us first so we can put it right. Email [email protected], write to us at [address], or tell any member of our team. We will acknowledge your complaint within 30 days and let you know what we find. You also have the right to complain to the Information Commissioner's Office.
A few points behind those choices:
- Give more than one channel. Email and post cover most people. If you have a shop or office, saying that staff can take a complaint in person reflects reality.
- State the timescale you work to. Thirty days is the legal limit for acknowledgement, not a target. If you usually reply within a couple of days, you can say so, but only promise what you can keep during holidays and busy seasons.
- Keep the ICO mention. People can still go to the regulator. Saying so openly tends to build trust rather than invite trouble.
- Avoid legal fog. Phrases like "data subject" and "controller" belong in the formal section, not the bit a worried customer reads first.
Should you build a form?
A dedicated web form is not required for a small business. A clearly published email address that someone actually monitors is a perfectly good route, and simpler to manage. If you do add a form, keep it short: name, contact details, what the complaint is about, and a free text box. Do not make fields like order number or account ID mandatory, because the complaint might come from someone who was never a customer, such as a person who received marketing they did not sign up for.
Whatever you choose, make sure submissions go to a shared inbox or to more than one person. A complaint that sits unread in the mailbox of someone on annual leave will run past the 30 days without anyone noticing.
Behind the page: a minimal process
The web wording is only the front door. A small business can run the rest with very little:
- One named person who owns data protection complaints, with a deputy.
- A simple log: date received, who from, what about, date acknowledged, what was done, outcome and date closed. A spreadsheet is fine.
- A short acknowledgement template that thanks the person, confirms what they raised and says what happens next.
- A habit of telling staff that complaints can arrive by any route, including a comment at the till or a reply to a marketing email, and that they must be passed on the same day.
The ICO suggests keeping a record of the acknowledgement, because it helps show you met the 30-day timeframe.
A quick website check this week
- Open your privacy notice. Is there a section that says how to complain to you, not only to the ICO?
- Does the email address in it reach a monitored inbox? Send a test.
- Is the privacy notice linked from the footer and from every form that collects personal data?
- On a phone, can you reach the complaints section in two taps from the home page? Our guest piece on checking mobile reading order shows why that view matters.
- Is the notice dated, so you can tell when it was last reviewed?
None of this takes long, and it has a side benefit. A business that makes it easy to complain usually hears about problems early, while they are still small and fixable.