The UK Data (Use and Access) Act 2025 (DUAA) is now 12 months old and from 19 June 2026, all organisations must provide a clear way for individuals to submit data‑protection complaints, acknowledge them within 30 days, and respond without undue delay. This new statutory duty applies to all organisations, including adult social care providers.
Under DUAA, is any complaint or concern that an organisation has infringed data‑protection law in how it processes personal data and examples include: poor data‑security measures or data breaches or improper collection, use, retention, or accuracy of personal data.
From now organisations must facilitate complaints by:
- Providing an easy, accessible way to complain (e.g., online form, email, phone, portal, live chat, in‑person) and accepting complaints through any channel, including social media or staff contact.
2. Acknowledge Within 30 Days
- An acknowledgement must be sent within 30 days of receipt of complaint.
3. Respond Without Undue Delay-providers must:
- Investigate appropriately and inform the complainant of the outcome promptly and keep the complainant updated on progress.
4. Record‑Keeping
- Providers must log complaints, actions taken, and outcomes.
5. Accessibility
Additional ICO Guidance Requirements includes
Informing individuals of their right to complain in privacy notices and when responding to rights requests, training staff to recognise and handle complaints and also verifying identity when complaints are made on behalf of others.
When setting up or reviewing DUAA complaint processes, remember that accessibility is not just good practice. The Accessible Information Standard (AIS) applies to providers of NHS and publicly funded adult social care services, who must have regard to it. It sets out how providers should identify, record, flag, share, meet and review communication needs linked to disability, impairment or sensory loss. Services outside the AIS still need to consider reasonable adjustments under the Equality Act 2010.
- In practice, providers should make sure complaint information, acknowledgements, progress updates and outcome responses are available in a format the person can access and understand. This may include Easy Read, large print, Braille, audio, email, text message, Text Relay, BSL interpretation or other communication support.
- Staff should check and record the person’s required or agreed communication method, arrange support promptly, and avoid sending standard print letters where this would not meet the person’s needs. Building AIS into the DUAA complaints process will help people raise concerns, understand the response and remain fully involved
For additional information and guidance on what this means for adult social care providers, please click link to Data (Use and Access) Act 2025: Briefing for adult social care providers – Digital Care Hub or contact the Data Protection Team at HCPA on 01707 718018 or dataprotection@hcpa.co.uk.