Section 164A — Data Protection Act 2018: Complaints by data subjects to controllers

Complaints by data subjects to controllers 164A 1 A data subject may make a complaint to the controller if the data subject considers that, in connection with personal data relating to the data subject, there is an infringement of the UK GDPR or Part 3 of this Act.

2 A controller must facilitate the making of complaints under this section by taking steps such as providing a complaint form which can be completed electronically and by other means.

3 If a controller receives a complaint under this section, the controller must acknowledge receipt of the complaint within the period of 30 days beginning when the complaint is received.

4 If a controller receives a complaint under this section, the controller must without undue delay—

a take appropriate steps to respond to the complaint, and b inform the complainant of the outcome of the complaint.

5 The reference in subsection (4)(a) to taking appropriate steps to respond to the complaint includes—

a making enquiries into the subject matter of the complaint, to the extent appropriate, and b informing the complainant about progress on the complaint.