Members only
The Information Commissioner’s Office is inviting SMEs to share their views on updates to its guidance following the introduction of the Data (Use and Access) Act 2025 (DUAA). The surveys relate to different pieces of draft guidance:
Survey: Guidance for organisations handling data protection complaints
By June 2026, organisations must have a process in place for handling data protection complaints. A complaint can come from anyone who’s unhappy with how an organisation has handled their personal information.
ICO’s new guidance sets out the requirements and informs organisations of what they must, should and could do to comply. It includes tips and practical advice for each stage in the process.
Please give ICO your views on draft guidance by 19 October 2025: ICO consultation on draft complaints guidance for organisations.
Consultation: ICO Complaints handling
A separate consultation on ICO's approach to data protection complaint handling was published on 22 August which asks for views on ICO’s proposed approach to assessing and determining the appropriate level of investigation ICO give to data protection complaints. See: ICO consultation on draft changes to how we handle data protection complaints. This closes on 31 October 2025.
Survey: Recognised legitimate interest guidance consultation
Recognised legitimate interest is a new lawful basis introduced into the UK GDPR by DUAA. It’s separate from the legitimate interests lawful basis.
ICO guidance will help to give organisations more confidence to use personal information for certain purposes in the public interest.
Organisations can use recognised legitimate interest for purposes such as crime prevention, public security, safeguarding, emergencies or for sharing personal information to help other organisations perform their public tasks.
Please give ICO your views on draft guidance by 30 October 2025: ICO consultation on draft recognised legitimate interest guidance.
Upcoming DUAA consultations
For more information about planned consultations on guidance, please see ICO’s guidance pipeline.
ICO says it greatly values the input of SMEs as it will help shape final guidance and ensure it is practical, clear and accessible.
