A new statutory right for individuals to complain directly to schools and academy trusts about how their personal data has been handled comes into force on 19 June 2026, under Section 164A of the Data Protection Act 2018 (DPA 2018).

This creates a distinct legal framework for responding to data protection-related complaints. While this is a new legal obligation, it's unlikely that schools and trusts have been ignoring data protection complaints previously and so this won't represent a new administrative burden. However, there are steps you can take to ensure you don't overcomplicate the complaints process.

This article sets out what the law requires, practical steps to get ready, and where to find further support.

New requirements

Section 164A of the DPA 2018 creates a distinct statutory right for individuals to complain directly to a school or trust where they believe there has been an infringement of the UK General Data Protection Regulation (UK GDPR) or the DPA 2018. This is a separate legal framework from schools' and trusts' general complaints regime, which is governed by the Education (Independent School Standards) Regulations 2014 for academies or the Education Act 2002 for maintained schools in England and Wales.

There are three core obligations under Section 164A of the DPA 2018:

1. Facilitate complaints. You must facilitate the making of complaints by taking steps such as providing a complaint form which can be completed electronically and by other means. The legislation uses the phrase "steps such as". Providing a form is given as an example, not an absolute requirement. 
2. Acknowledge receipt within 30 days. If you receive a data protection complaint, you must acknowledge receipt within 30 days of receiving it.
3. Respond without undue delay. If you receive a data protection complaint, you must, without undue delay, take appropriate steps to respond and inform the complainant of the outcome. Taking "appropriate steps" includes making enquiries into the subject matter of the complaint and keeping the complainant informed of progress.

Structuring your approach

To avoid overengineering the data protection complaints process, we recommend excluding data protection complaints from the scope of your general complaints policy or procedure, and instead addressing the framework within your Data Protection Policy. This keeps the two regimes clearly distinct and avoids confusion for both staff and complainants.

Including a well-drafted, short section in your Data Protection Policy will be easier to maintain, easier for staff to apply, and less likely to create confusion for complainants than a lengthier, prescriptive procedure. Importantly, this will be more manageable if you begin to see an increase in data protection complaints.

Our top tips for schools

Here are our top tips to help schools and trusts prepare for handling data protection complaints under the new framework:

1. Exclude data protection complaints from your general complaints policy. These are legally distinct and should be treated separately. Mixing the two regimes creates confusion for complainants and risks a data protection complaint being unnecessarily escalated through the different stages of your school or trust complaints process.
2. Set out your complaints process in your Data Protection Policy. A short, focused section covering the three statutory obligations is all you need. Keep it simple and avoid creating a separate standalone procedure.
3. Update your privacy notices and template response letters. In addition to informing individuals of the right to complain to the Information Commissioner’s Office and the right to enforce their rights through the courts, you should now also inform them of the right to make a complaint to the school or trust in the first instance.

Summary

Schools and trusts will have already been handling data protection complaints before Section 164A of the DPA 2018 came into force. With the increasing use of artificial intelligence tools to generate data protection complaints and information requests, a straightforward approach to handling these complaints will be key to ensuring your procedure remains manageable.

Support and resources

Our data protection support pack for schools and trusts contains detailed guidance on handling data protection complaints and template response letters to assist in dealing with complaints.

With our data protection CPD programmes, we’ll help you develop the skills and confidence to handle data protection effectively. Our support packs equip you with the resources to do it efficiently.

To discuss your specific circumstances, please contact our specialist Data protection guidance for schools and trusts team.