When living in the UK, your personal information is always "moving": it is handed over to an agency when applying for a visa, given to the landlord when renting a house, entered into NHS when seeing a doctor, and tracked by advertising platforms when shopping online. Once marketing text messages were abused, leaked or spam, many Chinese people in the past thought they would just "put it up and forget it." But starting from June 19, 2026, the rules have changed - this is the new law that came into effect just 6 days ago.
New UK data protection complaints rules: What exactly has been changed?
This change comes from the Data (Use and Access) Act 2025 (DUAA, Data Use and Access Act). It adds a hard obligation to the UK GDPR (UK GDPR) framework: all institutions (controllers) that process your personal data must provide clear complaint channels , and——
The complaint must be confirmed within 30 days after receipt, and the investigation must be carried out and the results notified "without undue delay". No organization is exempt from this obligation.
The scope of complaints is very wide: not responding to your data query request (SAR) within a time limit, sending out marketing after unsubscribing, cookie tracking crossing the border, data leakage, retaining your information for too long... As long as it involves violations of personal data processing, you can complain. And there are no restrictions on channels – emails, forms, phone calls and even social media messages all count. 📩
Step one: Complain to the British company itself
The core logic of the new regulations is "internal first, supervision later". So don’t go to the ICO immediately. must first make a formal complaint to that organization about . Write three things clearly: who you are, what happened, and what you want the other party to do (delete data/stop marketing/write explanation).
Keep emails and timestamps. In theory, the other party should reply to you within 30 days and give you the processing results. This step may seem simple, but it is the "evidence basis" for all subsequent rights protection - without it, regulatory agencies will usually send you back and go through the process again.
Step 2: If you are not satisfied, upgrade to ICO to complain.
If the company does not respond, is perfunctory, or you are dissatisfied with the result, the next step is to contact British Information Commissioner's Office (ICO, Information Commissioner's Office) , official website ico.org.uk to submit online for free.
⏰ Pay attention to a key time limit: is best to complain to the ICO within 3 months after receiving the company's "final reply". Delaying for too long will affect the acceptance. The ICO aims to have 90% of cases concluded within 6 months, but complex cases may take longer (some cases take around 40 weeks to be allocated to a commissioner). So the sooner you submit, the better.
Reminder: ICO is a regulator. It can determine that a company has violated the law, require rectification, and even fine you, but it will not pay you any compensation. If you want money, go to step three.
Step 3: Complain to the court for compensation according to law
If the data breach has caused actual damage to you, you have the right to claim compensation in accordance with UK GDPR Article 82 and Data Protection Act 2018 Article 168 . Damage is divided into two categories:
① material losses (material) - such as information leakage leading to fraud and loss of money; ② non-material losses (non-material distress) - such as mental pain, anxiety, and invasion of privacy. Section 168 expressly confirms that claims for moral distress may also be made.
In terms of process: the company can directly agree to compensate you; if it cannot reach an agreement, it will go to court to sue. But be careful - according to the case law Lloyd v Google [2021], you must prove that there is "concrete damage" (even if it is just provable mental anguish), otherwise the court will not only refuse to award compensation, but may also require you to bear the other party's legal costs. So be sure to assess whether the evidence is sufficient before making a claim.
Visa holders should especially pay attention: data = your permanent residence status
For people who are applying for permanent residence in the UK (ILR), personal data is not only privacy, but also the "chassis" of their identity. Indiscriminate filling in of forms by agents, errors in employer sponsor records, and mismatching of bank information may affect the continuity and authenticity of your future Settlement application. Complain when it is time to complain, correct mistakes when they should be corrected, and don’t let other people’s negligence drag you down for five or ten years.
As for how many days are left before your permanent residence countdown and whether the number of days you have left the country has crossed the 180-day red line, you can use 永居计算器 APP to calculate the number of days. If you encounter complex data or visa disputes, you are also welcome to ask our licensed lawyers on WeChat.
⚠️ This article is for reference only and does not constitute legal advice. Please consult a licensed attorney for specific cases.
[Data source] ICO new regulations: ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/06/new-data-protection-complaints-law-now-in-force/; Public complaint guide: ico.org.uk/make-a-complaint/data-protection-complaints/
💬 Let’s chat in the comment area: What bad things have you encountered in the UK where personal information has been misused – was it marketing text messages that were sent wildly after you unsubscribed, or was it an agency that misused your visa materials?
If you find it useful, please forward it to your friends who are also applying for permanent residence in the UK and are still worried about privacy and data. It can help them avoid detours at critical moments. 🔁
Dealing with a UK legal matter? JustiScript can help
⚡ CoS Slot Priority Service — £99
Automated priority submission the moment the Home Office releases Certificate of Sponsorship slots at 7:00 AM each working day.
⚖️ Ask a UK Lawyer — £5
One legal matter, an initial written response from a qualified UK lawyer within 24 hours.
✉️ Letter Before Action — £5
A formal pre-action letter on official letterhead, drafted in minutes. The step that settles most disputes before court.