The deadline is approaching fast. Are you prepared?

From 19 June 2026, the Data (Use and Access) Act 2025 (DUAA) will require schools, academy trusts and colleges to operate a clear, accessible and effective process for handling data protection complaints.

The ICO has made it clear: no exemptions for education providers. Every organisation must have a workable, compliant complaints route in place.

Why this matters

• A strong complaints process is more than a compliance tick-box. It helps schools respond consistently, reduce escalation and demonstrates to parents, staff and regulators that concerns will be handled properly and in a timely manner.
• Failing to act now risks complaints being mishandled and potentially investigated externally.

What’s changing

• The DUAA complaints rules are expected to take effect on 19 June 2026.
• Schools must allow people to raise data protection concerns, acknowledge complaints within 30 days, and address them without undue delay.

Complaints may arise from:

• Subject Access Requests (SARs)
• Data breaches
• Inaccurate or mishandled records
• Information sharing concerns
• Data retention issues

If someone believes their personal data has been handled incorrectly, you must be ready to respond quickly, clearly and consistently.

What you should you do now

To stay compliant, you should:

Review your policies immediately

Ensure your complaints policy, privacy notices and procedures clearly cover:

• Data protection complaints
• Responsibilities and ownership
• Timescales and escalation routes

Train your staff

Make sure all staff:

• Can identify a data protection complaint
• Know how to escalate it
• Understand who is responsible for handling it
• Receive refresher training every 1–2 years

Implement a consistent process

You must be able to:

• Log complaints systematically
• Acknowledge within 30 days
• Investigate thoroughly
• Respond promptly
• Record outcomes and actions taken

If your current process isn’t clear and consistent, it isn’t compliant.

How we can help

• Review your complaints framework
• Identify gaps and risks
• Update policies and procedures
• Ensure your processes are practical, compliant and ready