Overview

This course from Blocknorth gives complete beginners a clear, practical grounding in the Data (Use and Access) Act 2025 and the new UK data protection complaint-handling duties that came into force on 19 June 2026. It explains exactly what changed, when, and what a compliant complaints process looks like, in plain English and with no legal background assumed.

Target Audience

All staff and managers in organisations affected by this law. No legal or technical background required.

Learning Objectives

Upon completion, learners will gain a full and clear understanding of:

• The correct short title and citation of the Data (Use and Access) Act 2025, and why it is so often misnamed
• The difference between the Act's general commencement and the later commencement of its complaint-handling duties
• The four duties a data controller must meet under DPA 2018 section 164A, and the underlying right to complain that sits behind them
• Why section 164B is not yet a live reporting duty, and why that distinction matters
• The shift from a direct-to-regulator complaint route to a two-stage route, and what changed
• The building blocks of a compliant complaints process, and the common pitfalls that undermine one

Course Contents

Unit 1: What Changed and When

The exact name and citation of the Data (Use and Access) Act 2025, why it commenced in stages rather than all at once, the 5 February 2026 commencement of the wider data protection package, the 19 June 2026 commencement of the complaint-handling duties, and why those duties are not retrospective.

Unit 2: The New Complaint-Handling Duty in Detail

A full, section-by-section walk-through of DPA 2018 section 164A: the underlying right to complain directly to the controller, and the four duties that follow, facilitating complaints (with the method left to the controller), the 30-day acknowledgement deadline, responding without undue delay, and informing the complainant of the outcome. Also covers section 164B and the ICO's position that there are no exemptions for any organisation.

Unit 3: The Bigger Structural Change

How the Act omits UK GDPR Article 77 and amends DPA 2018 section 165, creating a two-stage complaint route: the controller first, then the ICO. What this means in practice for organisations and individuals, and what stays the same.

Unit 4: Building a Compliant Complaints Process

Turning the law into practice: creating a clear channel in, what "facilitate" really means, tracking the 30-day deadline, investigating properly, documentation and record-keeping, training staff who first receive complaints, and a practical closing checklist.