Your complaints procedure needs to be live in a few weeks.

What the Data (Use and Access) Act actually requires

UK GDPR has always given people the right to complain. The Data (Use and Access) Act, in force from 19 June 2026, makes the process mandatory. Every organisation has to:

• Provide a complaint form that can be completed electronically and by other reasonable means.
• Acknowledge each complaint within 30 days.
• Take appropriate steps to resolve it without undue delay.
• Inform the complainant of progress and the outcome.
• Keep records of what they did and why.
• Update their privacy notice to explain all of the above.

There is no SME exemption. If you process personal data, this applies to you. The deadline is firm.

Get the template that does the work for you

We put together a complaints procedure template designed for small UK businesses. It is the same structure we generate inside Rowpa. You can use it standalone, no Rowpa account needed.

Or skip the manual step. Let Rowpa generate yours.

The template is fine. Filling in the template, customising it for your business, keeping it aligned with your privacy policy, and tracking complaints when they come in is the bit that takes time.

Rowpa handles all of that:

• Generates your complaints procedure with your business details, your accountable person, your sectors, your sub-processors.
• Updates your privacy policy automatically so the wording matches.
• Gives you a public URL where complainants can submit a request.
• Tracks each complaint: deadlines, status, audit trail.
• Stays current with ICO guidance changes (we monitor daily).

Honest scope

Common questions