Rising demand sees ICO consult on changes to its handling of data protection complaints

The ICO said a significant increase in data protection complaints in recent years was impacting its ability to respond quickly and effectively.

In 2023/24, it received 39,721 complaints. In 2024/25 this rose to 42,881 and current forecasts indicate that this could increase to somewhere between 45,000 and 55,000 if the current trend continues, the watchdog reported.

The ICO said it wanted to consider new ways of handling data protection complaints. 

The consultation sets out its proposed framework to assess and determine the extent to which it is appropriate to investigate each complaint.

“This will allow us to focus on cases where we can have the most impact and improve data protection compliance,” it said.

The ICO noted that the Data (Use and Access) Act (DUAA) places new requirements on organisations to have a complaints process specifically for data protection related issues.

“Once the provision comes into force, we would expect that more complaints will be resolved by organisations without the involvement of the ICO,” it said.

“If people do bring their complaint to the ICO, we want to provide the most effective service given the finite resources we have. That means looking at our own approach to handling complaints.”

Its focus will now be on those cases where it will have the biggest impact.

“Organisations will also benefit from reduced routine engagement on lower-risk cases, enabling them to focus on the most significant concerns,” the ICO said.

“Our goal is not just to manage demand, but to raise standards around customer experience and regulatory effectiveness.”

The consultation, which also proposes new reporting mechanisms, runs until  Friday 31 October 2025.