From 19 June 2026, every care provider must have a formal process for handling data protection complaints made directly to them. This 2-minute check shows you what you need in place — and where your gaps are.
This is a plain-English explainer and readiness check, not legal advice. Tick what you already have in place, and you'll get back a clear picture of what's left to sort before the deadline. Always refer to the current ICO guidance for the detail.
The Data (Use and Access) Act 2025 (section 103) adds a new section 164A to the Data Protection Act 2018, in force from 19 June 2026. It applies to all data controllers, with no exemptions — which includes every care provider.
From that date, people can complain directly to you about how you handle their personal data, and they must raise it with you before they can take it to the ICO. You then have to deal with it properly: on the record, acknowledged within set timeframes, and answered without undue delay. Most small services have no formal process for this — and from the 19th, that's a gap an inspector, or a complainant, can point at.
Be honest — it's just for you. Tick the things that are genuinely set up and working today.