Tag: ICO consultation
If your product or community has age-limited features, you’ve probably looked at third-party age-verification (AV) tools. They can help with fast onboarding and higher assurance. They do not remove your responsibilities as a controller. A recent breach at a third-party provider handling age-check appeals is a reminder to tighten the basics.[i]
Below is a practical checklist you can apply this week.
1) Refresh your DPIA
Treat AV as a distinct processing activity. Update your Data Protection Impact Assessment (DPIA) with:
(a) categories of data the vendor collects, such as ID images and metadata,
(b) special-category or child considerations,
(c) risks if the vendor is compromised, and
(d) mitigations such as encryption, redaction, and retention controls. If you still identify high risks you cannot reduce, you must consult the ICO before you go live.[ii]
2) Get serious about processor due diligence
At a minimum, send potential vendors a security questionnaire covering access controls, key management, encryption at rest and in transit, and relevant certifications. Request a full list of sub-processors and evidence of breach management. Your contracts should mandate prompt breach notification, co-operation with investigations, approval of any sub-processor, transparency about data locations and robust audit rights. Many age-verification providers use third-party image-processing pipelines, so insist on visibility and the right to object to high-risk practices.
3) Data minimisation and retention
Only collect what you need to achieve the purpose. Prefer a pass or fail token and a coarse age band over storing full ID images. Where images are necessary, for example during appeals, set short retention periods and automatic deletion. Avoid internal copies of vendor-held data. Ask for privacy-preserving artefacts such as non-reversible tokens or signed assertions to prove checks occurred.
4) Build a clean incident playbook
Your playbook should name decision-makers in legal, PR, engineering, and security. Include steps to cut off the vendor, rotate keys, revoke scopes, switch to a fallback path, and notify affected users where required. Prepare clear comms templates and support routes. Rehearse the cut-over at least once a year.
5) Children and higher-risk contexts
If your service is likely to be accessed by children, align with the ICO’s Children’s Code. That means high privacy by default, clear and age-appropriate information, and DPIAs that reflect child-specific risks. In AV flows, design for dignity and accessibility. Offer alternatives for people who do not have passports or driving licences. Start with the ICO’s code and standards.[iii]
6) Understand DUAA timing and what changes
The Data (Use and Access) Act 2025 is being switched on in stages. Expect the main data-protection changes about six months after Royal Assent. The new duty to provide a data-protection complaints route is expected about twelve months after Royal Assent. Keep a simple internal timeline, assign owners, and log milestones such as policy updates, training, and website notices. See the government’s commencement plan[iv] and the ICO’s explainer.[v]
7) Recognised Legitimate Interests (RLI): plan, do not assume
RLI is a new lawful basis that will apply to specific public-interest purposes once commenced. Most commercial AV uses will still rely on consent, contract, or legitimate interests with a proper balancing test. Track the ICO’s draft guidance and plan a gap-analysis workshop when the final text lands.[vi]
8) Communicate clearly
Update your privacy notice with a dedicated AV section covering purpose, data types, vendor names, locations, retention, and user choices. Provide a one-screen summary in the AV flow with a link to full details. Make it obvious how people can raise a data-protection complaint with you now and how you will meet the new statutory process once it is in force.[vii]
9) Test your fallback
If the vendor goes down or trust is lost, what then? Offer a temporary pathway, for example age-band self-declaration with heightened moderation, or a pause with email support, while you switch vendors. Document the lawful basis for your fallback and the short-term risk trade-offs you accept.
Quick win checklist
- DPIA updated and signed off
- Processor due diligence complete and sub-processors logged
- Retention periods implemented and images set to auto-purge
- Incident playbook rehearsed and vendor cut-off tested
- Privacy notice section live and complaints route visible
- DUAA milestones tracked and training booked
[ii] ICO: when prior consultation is required; DPIA overview.
A Complaints Revolution?
What the Data (Use & Access) Act 2025 Means for Your Business
The UK’s data protection rules are changing again. Here’s what small and medium-sized businesses need to know about the new legal duty to handle data protection complaints and how to get ready.
Why this matters
The Data (Use & Access) Act 2025 introduces a major new responsibility for UK businesses. For the first time, organisations will be legally required to have a formal process for handling data protection complaints.
This means every business that processes personal data will need a clear way for people to raise concerns, and a plan for how those complaints are recorded, investigated and resolved.
The change builds on the existing UK GDPR and Data Protection Act 2018. It does not replace them, but it strengthens the rules around accountability and response times. The goal is simple: to make sure individuals can trust that their data rights are taken seriously.
If your business already manages data protection complaints properly, this may only mean a few small updates. But if you currently respond on an ad-hoc basis or tend to dismiss complaints that seem unfounded, it is time to make changes now.
The new duty in a nutshell
The Act received Royal Assent on 19 June 2025 and is being introduced in stages. The key stage for most organisations, current expected around 12 months from Royal Asset (so around mid- 2026), is the new legal duty to handle complaints.
Under this duty, you will need to:
- Acknowledge data-protection complaints within 30 days and tell people what will happen next
- Investigate and respond promptly, without unnecessary delay, explaining the outcome in plain language
- Record every complaint and document how and when it was resolved
- Train staff to recognise, log and properly escalate data-protection complaints
These rules apply to all organisations that process personal data, regardless of size or sector.
You can read the official rollout plan on GOV.UK https://www.gov.uk/guidance/data-use-and-access-act-2025-plans-for-commencement
Two ICO consultations shaping the change
The Information Commissioner’s Office (ICO) is currently running two consultations to help define what “good” looks like in complaint handling.
- Guidance for organisations, explaining how to set up and manage a complaint-handling process.
Deadline: 19 October 2025
ICO Consultation on Complaints Guidance for Organisations - The ICO’s own complaint-handling framework, which outlines how the regulator will assess and respond to complaints once the law is in force.
Deadline: 31 October 2025
ICO Consultation on Changes to How We Handle Data Protection Complaints
The first consultation tells you what your business needs to do. The second explains how the ICO will respond to complaints and what data they will monitor.
The risk of inaction
This is more than a procedural update. The ICO has made it clear that it will monitor complaint trends across sectors. Repeat or unresolved complaints could attract attention and follow-up engagement from the regulator.
If you do not have a reliable process in place, the risks include:
- Reputational damage if complaints are mishandled or ignored
- Evidence gaps that make it difficult to show compliance
- Closer scrutiny if your business appears in repeated complaint reports
Even complaints that seem minor or unjustified must be logged and responded to. If you choose to ignore them, they will still count towards your complaint history. The ICO will be looking for businesses that can show they act on feedback, not those that hope issues go away.
If you already manage complaints effectively, you are in a good position. If not, now is the time to act. Setting up a clear process will protect both your reputation and your compliance record.
What good looks like
A compliant complaint-handling process should feel simple and transparent. It should show that you take customers seriously and can evidence your actions.
The ICO’s guidance suggests focusing on:
- Visibility: make it easy for people to raise a concern, for example by publishing contact details or a form in your privacy notice.
- Consistency: respond within set timeframes and keep records of all correspondence.
- Evidence: log complaints in a way that allows you to track progress, outcomes and lessons learned.
- Governance: review complaint trends regularly to identify recurring issues or training needs.
If you already have a process in place, check that it meets these standards and that your team understands it. If you do not, start simple. A shared inbox and a basic log are often enough for smaller businesses, as long as they are used consistently.
The bigger picture
The new complaint-handling duty is part of a wider move towards greater accountability and user empowerment. Alongside this, the ICO has been setting out its approach to user consent, transparency and digital choice – including its views on Meta’s “consent or pay” advertising model.
Both developments point in the same direction. The UK is not deregulating data protection; it is making it more practical. The focus is on evidence and accountability – being able to show not just that you comply, but that you care about how personal data is handled.
What to do next
If you are unsure where to start, focus on these steps:
- Create or review your complaint process.
Have a clear route for people to raise issues, assign responsibility and set timeframes for acknowledgement and response. - Keep records.
Track all complaints, even if you think they lack merit. Record what was done, what you found and how you closed the issue. - Update your privacy notice.
Tell people how they can raise a complaint and what they can expect from you in return. - Train your team.
Make sure everyone who handles customer or employee data knows how to recognise and escalate a data protection complaint. - Review contracts.
Ensure any partners or suppliers who handle personal data know their role in your complaint-handling process. - Monitor and improve.
Look for recurring issues or delays. Fixing small process gaps now will reduce the risk of ICO involvement later.
How Athlex can help
At Athlex, we make compliance clear. We help businesses build practical, proportionate frameworks that work in the real world.
Our services include:
- Designing or reviewing complaint-handling frameworks
- Providing outsourced Data Protection Officer (DPO) support
- Reviewing contracts and supplier arrangements
- Updating privacy notices and policies
- Delivering tailored training and audits for your team
If you would like help reviewing your approach to complaints, start with a free GDPR Health Check. We will show you where you stand, what is working well and what to fix first.
Book your free data protection health check.
In summary
The Data (Use & Access) Act 2025 is not a complete rewrite of data protection law, but it will change how accountability is judged.
Businesses with clear, consistent complaint-handling processes will adapt easily. Those without one will need to move quickly. Ignoring complaints – even the unfounded ones – will no longer be an option.
Taking action now will save time later and show your customers that you value their trust.
