ICO launches new data protection complaints handling consultation

In response to a significant and growing backlog of cases, the Information Commissioner's Office (ICO) is consulting on a new framework for handling data protection complaints. According to the consultation document, the ICO has seen a substantial increase in complaints, receiving 42,315 in 2024/25, an average of 3,526 per month, with projections indicating these figures will rise to between 45,000 and 55,000 over the next two years. This surge in demand has resulted in a backlog of over 6,450 cases, with some complaints taking up to 26 weeks to be resolved.

The proposed data protection complaint handling framework aims to address this by moving away from a first-in, first-out approach and introducing a consistent triage system. This new process will allow case officers to assess each complaint based on criteria such as the impact of the data protection issue on the individuals affected or its relevance to the ICO's strategic priorities. The ICO claims this would enable it to allocate its finite resources more effectively and focus on the most significant cases and issues.

The changes are also influenced by the new Data (Use and Access) Act 2025 (DUA Act), which places initial responsibility for resolving data protection issues on organisations themselves. Ultimately, the ICO argues that its proposed new framework will deliver faster and more impactful outcomes, particularly for serious complaints, and will clarify the criteria for when an investigation will be conducted. Furthermore, the framework is designed to ensure proportionate and consistent decision-making while also improving overall data protection standards.

Related documents

• Scale of harm
• Draft impact assessment
• Equality Impact Assessment