Key takeaways
New statutory complaint handling obligations
Introduction of section 164A of the Data Protection Act 2018 will require schools and trusts to have procedures in place to manage and respond to data protection complaints.
Internal resolution before ICO escalation
Schools and trusts to become the first port of call for data protection complaints rather than the ICO.
Essential policy and notice updates
Updates to existing data protection policies and notices required to avoid regulatory intervention.
As of 19 June 2026, organisations will face a new and legally binding obligation when handling data protection complaints. Section 164A of the Data Protection Act 2018 is due to come into force which will introduce a statutory right for an individual to make a complaint to an organisation if there has been a breach of their data protection rights. This marks a significant shift in the UK data protection regime and requires all organisations to operate a complaints process for data protection complaints.
In short, section 164A establishes a statutory right for individuals to complain directly to a data controller if they believe the controller has infringed their data protection rights. This may include a complaint about:
how a subject access request (SAR) has been handled
perceived delays of failures to respond to rights requests
the lawfulness of data collection or use
data accuracy issues.
This is a change from the current regime under which individuals were free to raise a complaint directly to the Information Commissioners Office (ICO) without first seeking to raise the issue with the organisation. The introduction of section 164A will mean that organisations will serve as the first port of call for data protection complaints with individuals only able to escalate their complaints to the ICO if the organisation has responded (or failed to respond in an appropriate timeframe).
The aim of this new requirement is to reduce the number of complaints received by the ICO, by encouraging resolution between the data subject and data controller in the first instance.
What do schools and trusts need to do?
Section 164A places an obligation on organisations to facilitate the making of complaints. While section 164A is not overly prescriptive about how this may be achieved it does require the ability for the complaint to be submitted electronically (for example, by an online form) and by other means. Again, whilst section 164A does not set out a prescribed format for a data protection complaints policy, any policy implemented would need to meet the following key requirements under section 164A:
allows for the complaint to be acknowledged within 30 days of receipt
requires the organisation to make appropriate enquiries into the complaint and to keep the complainant to be updated on progress
requires the organisation to provide an outcome to the complainant without ‘undue delay’.
While section 164A does not set a statutory timeframe for a substantive outcome to be provided to a complainant, there is a requirement for the outcome to be provided without ‘undue delay’. Organisations should be mindful of this and ensure that adequate procedures are in place to avoid complaints drifting with no response and regulatory intervention and/or fines.
What should organisations do to prepare?
The introduction of section 164A applies to all organisations regardless of size or sector (including schools and trusts). This means that organisations will need to be prepared for the requirements imposed by section 164A and ensure that measures are in place before 19 June 2026 – this will include updates to policies, procedures, and any template outcome letters. Staff will also need to be made aware of this new obligation.
In practice, an organisation might find it easiest to meet its obligations under section 164A by introducing a new standalone policy to cover how such complaints should be handled. This will allow clarity for both employees and potential complainants to understand what is required and the correct procedure. The introduction of any new policies should be accompanied by staff training to allow staff to understand how complaints might be received and how they should be dealt with in the new procedures. Early preparation in advance of 19 June 2026 will be key to ensure compliance and minimise regulatory risk.
Our Education team at is well placed to advise education clients on any aspects arising from the implementation of section 164A – whether general advice, updates to policies, training or wider issues surrounding data protection.
Beyond this, we offer a full service to our education sector clients, whether you require advice on a transactional or commercial project, such as a school transfer, contract review, negotiation or settlement, or on day-to-day pupil, parent and staffing matters. Please contact our team for more information.
This article was co-authored by Trainee Solicitor, India Hall.
