ICO data protection complaints: what the ICO’s new triage framework means for individuals and organisations

The Information Commissioner’s Office has published a new data protection complaints framework explaining how it decides what to do when someone complains about the handling of their personal information.

For anyone considering an ICO complaint, or for an organisation that has received one, the message is clear: the ICO will not treat every complaint in the same way. It will triage complaints, decide how much involvement is appropriate and reserve deeper investigation for cases where the circumstances justify it.

This is important because many people still assume that making a complaint to the ICO will automatically lead to a full investigation, a finding against the organisation, compensation or an order requiring an apology. In practice, the ICO’s role is more limited and more risk-based than that, not least because the ICO does not have the resources to investigate every complaint made to it. The framework confirms that the ICO must investigate data protection complaints to the extent it considers appropriate and tell the complainant the outcome. The wording highlighted in bold in the previous sentence demonstrate that the ICO has discretion as to how far it goes in any particular case.

What is the ICO’s data protection complaints triage framework?

The ICO’s data protection complaints framework (which can be reviewed here) explains how the regulator checks whether it can deal with a complaint and, if it can, how it decides the level of action or investigation required. The ICO says it assesses complaints individually and uses triage criteria so it can focus on the most serious data protection issues, provide timely outcomes and support organisations in complying with their obligations.

That means some complaints may be looked at in more detail, while others may be recorded for information purposes only. This should not be misunderstood as the ICO ignoring complaints. Even where the ICO does not take further steps on a particular complaint, it may still use the information to identify patterns, emerging risks and wider regulatory concerns.

Why evidence and harm now matter even more

One of the most practical points in the ICO framework is the emphasis on the information supplied by the complainant. The ICO asks people to use its complaint form because it prompts them to provide the details the regulator needs. If a complaint is submitted without enough relevant information, particularly about the harm suffered, the ICO may decide to record it for information purposes only.

For individuals, this means a complaint should not simply say that an organisation has breached GDPR. It should explain what happened, when it happened, what personal data was involved, what right was exercised, what response was received, what remains unresolved and what impact the issue has had. Clear evidence is often the difference between a complaint that is easy to assess and one that is too vague to progress.

For organisations, the lesson is just as important. If a complaint reaches the ICO, the organisation’s earlier handling of the matter may come under scrutiny. A prompt, reasoned and well-documented response can make a significant difference. It shows that the organisation has taken the complaint seriously, considered the relevant data protection issues and made proper enquiries before reaching an outcome.

Should you complain to the organisation first?

In most cases, yes. Before the ICO becomes involved, it will usually expect the individual to have raised the issue with the organisation and given it an opportunity to respond. This is not just a procedural point. A well-prepared complaint to the organisation can narrow the issues, flush out documents and explanations and sometimes resolve the matter without the need for regulatory involvement.

From June 2026, organisations have had express legal duties around data protection complaints, including providing a way for people to complain, acknowledging complaints within 30 days and responding without undue delay. A poor or dismissive response may therefore create further difficulty for an organisation, especially where the ICO later reviews the complaint history.

What outcomes can the ICO provide?

The ICO may decide that the organisation has complied with data protection law, ask the organisation to do more work, make recommendations or use complaint information as part of its wider regulatory intelligence. In more serious cases, the ICO can take regulatory action. However, individual complaints do not usually lead to enforcement action on their own.

It is equally important to understand what the ICO cannot do. The ICO cannot award compensation, cannot usually force an organisation to apologise, and is not a substitute for bringing a civil claim where an individual seeks damages for distress, financial loss or misuse of personal information. That distinction matters when deciding strategy. A complaint to the ICO may be useful, but it is not always the complete answer.

How the ICO framework affects data protection claims

For potential claimants, the ICO framework makes early preparation even more important. A strong data protection complaint should identify the personal data involved, the relevant UK GDPR right or principle, the legal or factual failing alleged, the chronology, the supporting documents and the harm caused. If the complaint is poorly framed, the ICO may treat it as low priority, even where there is a genuine concern underneath it.

For organisations, the framework is a reminder that complaint handling is now part of data protection risk management. It is not enough to have a privacy notice and a set of policies sitting in the background. Staff need to recognise data protection complaints, escalate them quickly, preserve relevant evidence and respond in a way that is accurate, fair and legally coherent.

When should you seek legal advice?

Legal advice can be particularly useful where the complaint involves sensitive personal data, a data breach, inaccurate records, delayed or incomplete responses to a data subject access request, the misuse of private information, reputational harm, financial loss or distress. It can also help where a business needs to respond to a complaint in a way that is transparent and proportionate without making unnecessary admissions.

In many cases, the best approach is to think about the ICO complaint and any potential legal claim together. The ICO process may help clarify issues, but it has limits. A civil claim may be required where the remedy sought is compensation or a binding determination of legal rights. Equally, for organisations, a careful early response can reduce the risk of escalation, regulatory criticism and avoidable litigation.

Points to note from the ICO triage framework

• The ICO will assess each data protection complaint individually and decide how much involvement is appropriate.
• Not every complaint will lead to a detailed investigation.
• Evidence, chronology and harm are central to how a complaint is assessed.
• Individuals should usually complain to the organisation first and keep a clear paper trail.
• Organisations should have a practical complaints process and respond promptly, clearly and lawfully.
• The ICO cannot award compensation, so legal advice may be needed where damages or wider remedies are sought.

The ICO’s triage framework does not make data protection complaints less important. If anything, it makes them more strategic. A complaint that is clear, evidenced and properly focused is more likely to be understood quickly. An organisational response that is timely, practical and well reasoned is more likely to reduce regulatory and litigation risk. Whether you are an individual concerned about the misuse of your personal data or an organisation facing a data protection complaint, the framework is a useful reminder that preparation, evidence and proportionality are often decisive.