1. New legal right to raise concerns
On 19 June 2026, a major change to UK data protection law came into force. Under the Data (Use and Access) Act 2025, employees and other individuals now have a legal right to raise data protection concerns directly with an organisation before taking their complaint to the Information Commissioner’s Office (ICO).
For HR professionals, this means that data protection issues are increasingly likely to land on your desk first.
2. What has changed?
In the past, many data protection concerns were raised directly with the ICO. Employers are now expected to deal with these issues internally, wherever possible. They should demonstrate that they have effective procedures in place for receiving, investigating and resolving complaints.
3. What type of complaints can be made?
Complaints could cover a wide range of workplace issues, including:
- employee monitoring
- mistakes in personnel records
- delays in responding to subject access requests
- inappropriate sharing of personal information
- concerns about how artificial intelligence (AI) is being used in employment decisions
4. How should complaints be dealt with?
The new law requires organisations to have a process for handling data protection complaints. Employers must acknowledge complaints within 30 days and investigate and respond without unnecessary delay. Failing to do so could potentially amount to a breach of data protection law in its own right.
5. Advice for HR teams
You should take steps now to review current arrangements.
- Update policies and procedures where necessary.
- Complaint reporting channels should be clear and accessible.
- Train managers to help them recognise when a data protection complaint has been raised.
- Review escalation routes to ensure concerns are referred promptly to the appropriate individuals within the organisation.
- Note that employees do not need to use legal language when raising a concern and they may not even describe it as a complaint. For example, an employee saying, ‘I don’t think you should be using my information like that’ could be enough to trigger an organisation’s obligations under the legislation.
Further reading
- For Organisations – Information Commissioners Office
- How to manage personal data breaches at work – Hunter Law
- GDPR rules for monitoring employees – Hunter Law
If you enjoyed this blog then perhaps you’d like to sign up to our monthly newsletter. We’ll keep you updated on what’s new in employment law.
The team at Hunter Law is here for you. We can handle your HR issues, finesse your policies, and keep you up-to-date on evolving legislation. Please get in touch with our legal team, we’d love to help.
