Is your business ready for new data complaints rules? A practical overview

The issue

On 19 June, a new data protection (DP) complaints obligation came into force, regulating how organisations must handle concerns about how personal data is being used. However, many businesses may still be underestimating what this means in practice.

DP complaints often follow Subject Access Requests. SARs are becoming more numerous and complicated. Individuals are more aware of their rights and have tools such as AI to help them exercise these more readily.  This is leading to an increase in DP complaints.

Hospitality businesses may be particularly exposed. Hotels, restaurants, pubs, and caterers hold large volumes of personal data, such as booking and payment information, marketing preferences, and employee records.

A complaint that is missed or handled poorly presents a regulatory risk, but it can also become a wider legal or reputational problem.

The law

The Data Protection Act 2018 now sets standards for facilitating, acknowledging, investigating, and responding to DP complaints. It begins with giving individuals an easy and clear way to raise concerns.

Resolving complaints at this stage may avoid escalation to the Information Commissioner’s Office (ICO), although individuals always retain the right to complain to the ICO or raise court proceedings.

Without an effective process or suitably trained staff, complaints may be missed or escalated too late. Deadlines may pass, and any related data breaches or SARs overlooked, increasing the risk of ICO scrutiny, compensation claims, and reputational damage.

How to take action

1. Start with existing procedures

Hospitality businesses do not necessarily need a new system. DP complaints can often be incorporated into existing guest relations, customer service, or general complaints procedures.

A named person/team should oversee complaints, monitor deadlines, coordinate the investigation, and manage the correspondence. Multi-site operators should ensure concerns are handled consistently through a central process.

2. Make the complaints route clear

Businesses should update their privacy notices to explain how someone can submit a DP complaint. It is best to signpost both online and offline routes such as a web form, email address and postal address, although individuals cannot be forced to use any particular route. All are valid.

3. Prepare staff for complaints through any channel

A complaint may be raised verbally, through social media, or as part of a wider customer service issue. A guest might say their booking confirmation was sent to someone else or that marketing emails continued after they opted out.

Frontline staff do not need detailed legal knowledge, but they should know what a DP complaint looks like and where to refer it. They should record what was said, when it was received, and who raised it, then pass it on promptly without commenting on the facts or promising any particular outcome.

4. Record, investigate, and check for wider obligations

The internal complaint record should identify the data and processing activity complained of, and any venue, system, or supplier that may be responsible. Relevant booking records, emails, CCTV logs or marketing preferences should be secured.

The complaint should also be managed alongside other obligations. It may be combined with a SAR or another data right, or it could reveal a data breach which will trigger a more urgent investigation and potential reporting requirements.

5. Use complaints to prevent repeat problems

A central record may reveal repeated DP issues such as marketing opt-out failures, booking confirmations being sent to old addresses, or former employees retaining system access. Trend analysis allows a business to understand and address underlying systemic causes and to decide on best follow-up action, for example, system changes, better supplier oversight, or refreshed staff training.

6. Take care with the response and seek advice

Businesses should not assume statements made during the complaints process are protected from later use. Any admission or information provided at any stage could be used for other purposes, such as an ICO complaint, employment dispute, or compensation claim. Hiding mistakes or providing misleading information is not however lawful.

Where the matter is particularly complicated or sensitive, or the complaint overlaps with wider legal proceedings, it would be best to seek specialist advice on dealing with the DP complaint.

A manageable risk

The new obligation is manageable, but it requires a clear process, trained staff, and careful handling. Getting the basics right, rather than overengineering a new process, could be the difference between resolution and further regulatory, legal, or reputational complications.

If you or your company would benefit from advice surrounding the concepts addressed in this article, please contact Cinzia Biondi.

A version of this article was featured in The Caterer.