A new statutory right for individuals to complain directly to schools and academy trusts about how their personal data has been handled comes into force today (19 June), under Section 164A of the Data Protection Act 2018. 

This creates a distinct statutory right, separate from schools' and trusts' general complaints regimes governed by the Education (Independent School Standards) Regulations 2014 for academies or the Education Act 2002 for maintained schools.

Under the new framework, schools and trusts must facilitate complaints by taking steps such as providing a complaint form and acknowledge receipt within 30 days of receiving. 

They are required to respond “without undue delay”, with appropriate steps they should take to respond to a complaint including making enquiries into the subject matter and keeping the complainant informed of progress.

Bethany Paliga, Senior Associate specialising in data protection in the education team at UK and Ireland law firm Browne Jacobson, said: “This new obligation arrives at a time when schools are already under significant pressure from a surge in complaints. Our spring 2026 School Leaders Survey, representing leadership of over 1,000 schools and more than half a million pupils, found that 90% of leaders say parents are escalating complaints more quickly than two years ago and 46% report that complaint volumes are approaching or have already reached breaking point.  

“Data protection complaints are part of this wider trend. We are seeing a clear rise in data protection litigation claims against schools, driven by greater access to AI tools, declining trust in public institutions and growing awareness of individual data rights.

“Schools and trusts should not be alarmed by this new obligation, but they should be realistic about the environment in which it is being introduced. We recommend excluding data protection complaints from the scope of a school’s general complaints policy and instead addressing the framework within its data protection policy. This keeps the two regimes clearly distinct, avoids confusion, and is far easier to maintain than a standalone procedure – particularly at a time when schools are already stretched.

“Our practical advice to schools and trusts is to keep it simple, keep it separate, and keep it current. A short, focused section covering the three statutory obligations in the data protection policy is all schools require, with no need for a standalone procedure. 

“Data protection complaints are governed by different legislation from general complaints and should follow a different path, so don't fold them into an existing complaints policy. 

“Schools should also take this opportunity to update their privacy notices and template letters so that individuals know they can raise a data protection complaint directly, making the school or trust the first port of call rather than the ICO or the courts.

“Handled well, this change should help schools address data protection concerns promptly and thoroughly, ensuring schools are well placed to defend their approach in the event of escalation to the regulator or to litigation.”