<\/p>\n
The new complaint-handling regime provided for under\u202fthe Data (Use and Access) Act (DUAA)\u202fapplies from Friday 19 June and applies to any form of infringement under the UK General Data Protection Regulation (GDPR), not just to things like personal data breaches. <\/p>\n
Data protection law experts Kathryn Wynn<\/a> and Malcolm Dowden<\/a> of Pinsent Masons said businesses can expect their GDPR complaints handling to be tested by individuals and to be subject to scrutiny by the UK\u2019s Information Commissioner\u2019s Office (ICO). However, they advised organisations not to handle GDPR complaints in a silo, warning that doing so could risk non-compliance with other complaints handling obligations they face.<\/p>\n Wynn said: \u201cWe are expecting to see the complaints process used more extensively in relation to DSARs, so organisations need to be careful about basic procedural errors which can easily occur in high volume, complex DSARs. Organisations should also think about contractual terms to ensure that suppliers and service providers are contractually obliged to support with complaints.\u201d<\/p>\n Dowden said: \u201cThe practical implications go further than simply having a procedure on paper. Organisations must ensure that their complaints handling is joined up.\u201d<\/p>\n \u201cData protection complaints will often run alongside other mandatory complaints procedures with different requirements and deadlines. For example, a complaint relating to automated decision-making or profiling might simultaneously engage ICO oversight and, for financial services firms, FCA duties under the consumer duty<\/a>\u00a0and the DISP framework<\/a>. A siloed approach, where data protection complaints are handled in isolation from wider customer complaints governance, is a real operational risk,\u201d he said.<\/p>\n