Data protection complaints at work: how employees can use the new statutory right

Quick answer

From 19 June 2026, employees and other individuals have a clearer statutory route to complain directly to an employer about how their personal data is being used. You do not need to say “GDPR”, quote the law, or use any formal legal wording. If you raise a concern that your information is being misused, mishandled, kept inaccurately, shared wrongly or used unfairly, your employer may need to treat it as a data protection complaint.

Key takeaways

·        A data protection complaint can be raised informally, including during a grievance, disciplinary process, during redundancy consultation or in an employment dispute.

·        The employer must give people a way to complain, acknowledge the complaint within 30 days, investigate without undue delay, keep the person updated and explain the outcome.

·        It does not replace a subject access request, but it can support a more formal request.

What changed on 19 June 2026?

The Data (Use and Access) Act 2025 (DUAA) added a new complaints route into the Data Protection Act 2018. Employers who are data controllers must now operate a process for handling complaints about data protection.

Workplace disputes often involve personal data, such as sickness records, occupational health reports, disciplinary allegations, absence data, monitoring records, emails, Teams messages, CCTV, performance information or investigation documents.

Employees already had rights under the GDPR, including the right to make a subject access request, ask for inaccurate data to be corrected, object to certain processing and complain to the Information Commissioner’s Office (ICO). Those rights still exist. However, the new right makes the internal complaint stage clearer and harder for employers to overlook.

What counts as a data protection complaint?

A complaint may be any concern that the employer has breached data protection law in the way it has handled personal information. The employee does not need to label it correctly.

For example, these statements could amount to a data protection issue:

·        “I do not think you should be using my medical information in this way.”

·        “The notes on my HR file are wrong.”

·        “Why has my manager shared this with other people?”

·        “I object to this monitoring being used in the disciplinary process.”

The concern may sit inside a wider employment dispute. An employee may raise a grievance about unfair treatment and also complain that the employer is relying on inaccurate HR notes. A claimant negotiating a settlement agreement may question why certain emails or performance documents are being used against them.

What must the employer do?

An employer should not ignore a data protection complaint because it has been raised informally.

Under the DUAA, the employer must now give people a clear way to make data protection complaints directly. The ICO says the organisation can decide how to do this, but examples include a complaint form that can be submitted electronically or in writing, an email address, telephone route, online complaints portal, live chat, post or an in-person route. For employers, the safest approach is to provide a clear electronic route and at least one practical alternative, so employees are not forced into a single channel.

Once the complaint is received, the employer must acknowledge it within 30 days. It must then investigate without undue delay. That means making appropriate enquiries, checking records, speaking to relevant staff where needed, and assessing whether the data has been handled lawfully, fairly and accurately.

The employer must keep the employee informed and tell them the outcome without unjustified delay. The response should explain the conclusion and any action to be taken.

How can employees and claimants use this right?

As well as rectifying privacy mishaps, used properly, the new complaints route can be used as a practical and strategic tool in resolving workplace disputes.

First, it can force clarity. If an employer is relying on personal data in a disciplinary, redundancy, performance or other employment situation, the employee can ask why that data is being used, whether it is accurate, who has seen it and what lawful basis is relied on.

Second, it can create a useful evidence trail. If the employer fails to acknowledge, investigate or respond properly, that may become relevant background evidence in a wider dispute. It may show poor process, weak record keeping or a failure to take data rights seriously.

Third, it can help narrow the dispute. If the complaint leads to correction of inaccurate records, deletion of unnecessary data, restriction of processing, better disclosure or a clearer explanation, the employee may be better placed to decide their next step.

A data protection complaint can also sit alongside a more formal subject access request, and can be used in the context of a grievance, whistleblowing concern, discrimination complaint, unfair dismissal claim or in settlement negotiations. It should however be used carefully; the best complaints are specific, factual and linked to the data being challenged.

Practical steps for employees

If you are in a dispute and worried about personal data, ideally put your concern in writing. Identify the information, explain what you think is wrong, say what outcome you want, and ask for the matter to be treated as a data protection complaint.

For example:

“I am raising a data protection complaint. I do not believe the company should be using the absence notes dated [date] in this disciplinary process because they are inaccurate and were shared more widely than necessary. Please confirm the lawful basis for using this information, who has received it, whether it will be corrected, and what steps will now be taken.”

Keep copies of your complaint, the acknowledgement and any response. If the employer does not deal with it properly, you may then be able to escalate the matter to the ICO.

Final point

This new right is not a shortcut to compensation and it does not automatically win an employment claim. But it gives employees a clearer way to challenge how their personal data is being used at work. In a live dispute, it may expose inaccurate records, poor disclosure, excessive sharing, unfair monitoring or weak HR processes before decisions are made.

Speak to our team about workplace disputes involving personal data.

This article provides general information only, based on UK data protection and employment law as at June 2026. It is not legal advice and must not be relied on as such. Outcomes depend on your circumstances.

Article written by
Yeing-Lang Chong

At Springhouse Solicitors we offer a range of services, so please contact our friendly customer services team to discuss further via  hello@kilgannonlaw.co.uk or  0800 915 7777.

Disclaimer 

The above provides a general overview of areas in employment law and is not intended nor construed as providing specific legal advice.  This article is for information purposes only and is correct at the time of publication. It does not constitute legal advice.

23.06.26