Since 19 June 2026, employees have a new statutory right to raise data protection complaints directly with their employer, rather than going straight to the Information Commissioner’s Office. It’s a quiet change compared to the headline reforms of April, but it has real, practical consequences for how HR handles day-to-day data requests — and most businesses haven’t updated their processes for it yet.
What’s Actually Changed
Under the Data (Use and Access) Act 2025, individuals — including employees — now have a formal route to complain to the organisation holding their data before (or instead of) going to the ICO. Previously, someone unhappy with how their personal data was handled had to raise it with the regulator directly. Now, that complaint can land squarely with you.
The most likely trigger in an HR context is a subject access request (SAR). If an employee isn’t happy with how you’ve handled their SAR — too slow, incomplete, redactions they don’t understand — they can now make a formal complaint about it, and you’re expected to have a proper process to receive and manage that complaint internally.ly useful.
Why This Matters More Than It Sounds
This isn’t just a courtesy step before someone goes to the ICO. A failure to have arrangements in place to receive and respond to these complaints can itself amount to a breach of data protection law. In other words, the absence of a process is now a compliance risk in its own right — separate from whatever the original complaint was about.
For HR teams, this is particularly relevant because SARs are one of the most common data protection flashpoints. They often surface during or after a grievance, disciplinary process, or exit — exactly the moments when an employee is most likely to be unhappy with what they’ve received, how quickly, or what’s been withheld.
What Employers Need to Put in Place
A clear internal complaints route. Employees need to know how and where to raise a data protection complaint — this shouldn’t require them to already know about the ICO or file a formal grievance to be heard.
A defined response process. Who receives the complaint, who investigates it, what the timescale is, and how the outcome is communicated back to the employee.
Proper documentation. Given the criticism tribunals have levelled at employers who can’t show their working in other recent cases, treat this the same way: log what was raised, what was reviewed, and what was decided.
Manager and HR awareness. Whoever handles SARs and data queries day to day needs to know this route exists and isn’t optional — it sits alongside, not instead of, the employee’s right to go to the ICO at any time.
The Bigger Picture
This change sits quietly alongside the bigger April 2026 reforms, but it’s the kind of thing that gets tested in practice rather than headlines — usually when a SAR response lands badly during an already tense HR process. Building the internal complaints route now, before it’s needed, is far easier than improvising one under pressure.
Not sure your current SAR process would hold up to a formal complaint? Get in touch with the Cheviot HR team to talk through what needs updating.