DSARs and the new statutory right to complain – what does this mean for employers?

Tyler Ross, Solicitor

Over recent years there has been a rapidly rising trend in employees submitting data subject access requests (DSARs) to access their personal data held by their employer. This is a common tactic for employees engaged in litigation (or considering litigation) or in settlement discussions to try to improve their negotiating position, either by causing a nuisance or in an attempt to get their hands on the perceived “smoking gun” to support their claims.

From 19 June 2026, individuals gained a new statutory right to complain directly to a data controller, for example their employer, about their data protection rights.

What is a data protection complaint?

A data protection complaint arises when an individual believes an organisation has mishandled their personal data request. The most common type of complaints we see relate to an employer’s handling of a DSAR, for example the time it took for an employer to respond to the request or an employer’s approach to redacting information.

Employees can now raise a complaint via any channel, and they do not need to use legal terminology or even call it a ‘complaint’. If an employer is unsure whether an employee is making a data protection complaint, then they should ask them for clarification.

What do employers need to do?

These reforms require employers to now:

• Provide an accessible way for employees to submit a data protection complaint;
• Acknowledge complaints within 30 days of receipt;
• Take “appropriate steps” to investigate complaints without undue delay;
• Keep those who have made a complaint informed about the progress and outcome of complaints without undue delay; and
• Maintain appropriate records relating to complaints and their resolution.

Employers are also required to inform employees about their right to complain:

• At the time their data is collected, such as in its privacy notice; and
• When responding to a DSAR, or other data protection request.

What are the consequences for employers for getting it wrong?

Employees can still complain directly to the Information Commissioner’s Office (ICO). However, the new right has been introduced to ease the ICO’s workload and to encourage individuals to complain directly to a data controller itself.

Currently, the ICO is advising that it can take up to 40 weeks following a complaint to them for the case to be assigned to a case officer. Some complaints are then taking more than 6 months on assignment to be resolved. The new right to complain directly to a controller almost inevitably means that employers will see an increase in the number of data protection complaints they receive.

If an employer does not handle a complaint correctly, they risk breaching UK data protection law and being subject to a range of penalties. This can include fines from the ICO of up to £8.7 million or 2% of total global turnover (whichever is higher) and compensation being awarded to an employee by a civil court.

If you require assistance with updating your privacy notice or other data protection policies, implementing a complaints procedure or require advice upon receipt of a data protection complaint from an employee, please contact the Kuits employment team on 0161 832 3434 or [email protected].