In June 2026, new rules relating to the handling of data protection complaints are due to come into force, which will apply to all organisations acting as controllers of personal data. Commercial solicitor Ashleigh Dibb from Forbes Solicitors explains why subscription businesses should now review and prioritise their customer complaints processes.
The Data (Use and Access) Act 2025 (DUAA) introduces amendments to the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA) and the Privacy and Electronic Communications Regulations (PECR). The reforms are intended to simplify certain aspects of the UK’s data protection framework, support innovation and encourage responsible data sharing, while maintaining high data protection standards
As part of these changes, from June 2026, organisations acting as data controllers will need to ensure that they have effective processes in place for individuals to raise complaints about the handling of their personal data.
Don’t make assumptions
Successfully managing customer data is crucial for many subscription providers, which rely on accurate personal information to tailor marketing and customer engagement strategies. Personalised and targeted promotions can help reduce customer cancellations, improve subscription renewals and increase acquisition conversion rates. It can also create opportunities for cross-selling, upselling and rewarding customer loyalty.
Given the value of actionable customer data, many businesses across the subscription economy are already at the forefront of data protection best practice. As a result, many providers may have robust customer complaints processes in place, however, organisations should not assume these existing processes will automatically meet the new requirements introduced under the DUAA.
From 19 June 2026, individuals will have a clearer statutory route to raise complaints about the processing of their personal data. The new rules are intended to encourage organisations to address concerns directly and transparently, before matters escalate to the Information Commissioner’s Office (ICO), which will oversee enforcement of the regime.
Non-compliance with the new rules, and breaches of individuals’ data protection rights, could expose businesses to substantial regulatory penalties. Depending on the nature and seriousness of the infringement, the ICO has the power to issue fines of up to £17.5million or 4% of global annual turnover for the most serious breaches.
The need for documentation and transparency
Under the new laws, organisations will need to provide individuals with a clear and accessible way to submit complaints. This may mean, for example, allowing subscribers to raise complaints through a range of channels such as email, WhatsApp, phone or an online form. Businesses should consider whether their complaints process is sufficiently visible and accessible through the communication method they commonly use with individuals.
The DUAA will also introduce a requirement for data protection complaints to be acknowledged within 30 days and investigated without undue delay. Businesses will need to keep individuals updated throughout the handling of their complaint, provide clear and understandable outcomes, and ensure there are appropriate routes for escalation where necessary.
While the DUAA does not expressly require organisations to implement a standalone complaints policy, subscription businesses should treat documentation as an important part of compliance. ICO guidance confirms that organisations can adapt existing complaints policies or data rights procedures, rather than creating an entirely separate process. This reflects the wider accountability principle of the UK’s data protection law, which requires organisations to be able to demonstrate compliance with their obligations.
For subscription businesses, there are multiple and regular customer interactions involving the processing of personal information that could give rise to complaints, including billing, renewals and customer service issues. Clear documentation across these touchpoints can ensure there’s consistent and reliable evidence of decision making to support compliance.
Organisations should also consider updating their privacy notices, so individuals are clearly informed about how to raise a data protection complaint. It is important that updated privacy notices are aligned with other policies and procedures, to ensure that complaint handling becomes embedded throughout customer services and day-to-day operations. For example, many subscription businesses will deliver services via partnerships with third parties, such as logistics providers. Complaints may involve issues relating to customer addresses and personalised in-pack promotions.
Review contractual arrangements
Contractual arrangements with third parties should also be reviewed to ensure they adequately cover the handling of data protection complaints. Agreements may need to include obligations requiring suppliers to promptly notify a subscription business (as a data controller) of any complaint relating to personal data. Subscription providers may also require third parties to provide reasonable assistance to support their privacy notice obligations and complaint-handling procedures.
Ahead of 19 June 2026, organisations should review whether their existing complaints, privacy and customer service processes adequately address data protection complaints. The new DUAA requirements are intended to encourage concerns to be resolved directly between individuals and organisations, before escalating to the ICO. Clear procedures, accessible reporting routes, staff awareness, and consistent record-keeping will therefore become increasingly important elements of data protection compliance.
Subscribe!
Our editor carefully curates two InternetRetailing newsletters a week filled with up-to-date news, analysis and research. In addition to this, there is a dedicated mailer focusing on the subscription economy every second Wednesday – click here to subscribe to the FREE newsletter.
