The Data (Use and Access) Act 2025 became law in the UK last year; it makes some changes to existing UK data protection legislation, i.e. the UK General Data Protection Regulation (UK GDPR), the Data Protection Act (2018), and the Privacy and Electronic Communications Regulations (PECR).
One of the changes, which comes into effect as of Friday 19 June 2026, is that data subjects are able to make complaints to a data controller (e.g. the University) in relation to their own personal data, if they think that the controller has not complied with data protection legislation or has mishandled their personal data. Data controllers are required to facilitate this, to acknowledge these complaints within a statutory timescale, and to respond to the complaints ‘without undue delay’.
What does this mean for the University?
In light of this change, the University now has a Data Protection Complaints Procedure in place; details of this can be found on our data subject rights webpage. As outlined in the procedure, Data Protection complaints will be dealt with by the University’s Data Protection Officer.
What should I do if I receive a data protection complaint?
Whilst we will be directing individuals to the procedure wherever possible, which provides the details of how to get in touch with the Data Protection Officer (DPO), it may be the case that you still receive data protection-related complaints in the course of your own ‘business as usual’ processes.
Where this is the case, the details of the data protection complaint should be forwarded to dpo@sussex.ac.uk immediately so that the complaint can be acknowledged and considered in line with the established process. Given that there are statutory timescales attached to this process, it is important that there is no delay in sending these across to the DPO.
Note that if the complaint is submitted as part of a broader matter that you or your team are responsible for dealing with, the data protection element of the complaint must still be referred to the DPO straight away.
If you have any questions about the process, or anything related to data protection or data subjects’ rights, please just contact the Information Management team via dpo@sussex.ac.uk.