Technology & AI · Polar Small Business Update
New data complaint rules: what every small business must provide
A new legal duty is now in force for organisations handling personal information. The practical fix is a clear route, an owner and a simple response record.
Polar in 30 seconds
You must give people a clear way to make a data-protection complaint, acknowledge it within 30 days, investigate appropriately, keep the person informed and explain the outcome without undue delay. This applies to small organisations too—not only large companies with a legal department.
What is a data-protection complaint?
It is a concern about how your organisation has collected, used, shared, stored, corrected or deleted someone’s personal information. The person does not need to quote the law or use the words “data-protection complaint” for the message to count.
Examples include a customer saying their details were sent to the wrong person, an ex-employee disputing inaccurate records, or someone complaining that marketing continued after they opted out.
What the new process must do
Make complaining clear
Provide an obvious email address, form or written route and explain what information helps you investigate.
Acknowledge within 30 days
Confirm that you have received the complaint and tell the person what happens next.
Investigate properly
Check the relevant systems, messages, permissions, records and people rather than issuing a stock reply.
Explain the outcome
Keep the complainant informed and, without undue delay, state what you found and what action you will take.
A small-business setup that is good enough to use
- Add a “data protection complaints” paragraph to your privacy page and contact page.
- Choose one monitored email address and one responsible person.
- Create a log with the date received, acknowledgement date, issue, evidence checked, decision and action.
- Prepare a plain-English acknowledgement that gives a reference and expected next step.
- Tell staff how to recognise a complaint and where to forward it immediately.
- Set reminders well before the 30-day acknowledgement limit.
- Review repeated complaints for a wider process or security problem.
Do not confuse a complaint with a rights request
A complaint may arrive alongside a request for access, correction, deletion or objection. Those rights can have their own legal timescales. Log each part separately and check the ICO guidance rather than assuming the 30-day acknowledgement rule replaces every other deadline.
A plain acknowledgement example
“Thank you for raising your concern about how we handled your personal information. We received it on [date] and have recorded it under reference [number]. [Name or role] will review the relevant records and contact you if more information is needed. We will keep you informed and explain the outcome as soon as the investigation is complete.”
Protect the records behind the process
A complaint can reveal a broader weakness in access, storage or staff practice. Pair the complaints process with the Polar small-business cyber-security checklist and keep complaint records accessible only to people who need them.
Official sources
This article is general information, not legal advice. Check the ICO guidance and take advice where a complaint is complex or disputed.