It has now been nearly two months since 19 June 2026 — the date the most operationally significant provisions of the Data (Use and Access) Act 2025 (DUAA) came into force. For professionals in UK regulated industries — finance, legal, banking, and healthcare — the post-June landscape has fundamentally changed how organisations must handle data protection complaints, manage document retention schedules, and demonstrate accountability through secure document destruction.

Yet many organisations are still catching up. The ICO has been clear: sectors where data protection complaints are most common include healthcare, financial services, technology and retail — precisely the industries where the stakes are highest and the compliance burden most acute.

This article examines the critical intersection of the DUAA's new complaints-handling regime and your document retention and destruction obligations — and what you must do right now to stay compliant.

The DUAA introduced a statutory right for individuals to complain directly to data controllers — including their employers and service providers — about alleged UK GDPR infringements. Under the new Section 164A of the Data Protection Act 2018, organisations must now:

• Provide at least one accessible complaints channel (online form, email, phone, or in-person)
• Acknowledge complaints within 30 days of receipt
• Investigate and respond without undue delay, keeping complainants informed throughout
• Maintain auditable records of all complaints, investigations, and outcomes
• Update privacy notices to inform individuals of their right to complain internally

This is not merely a procedural update. It represents a fundamental shift in how data protection accountability is demonstrated — and it has direct implications for how long you retain documents and how you destroy them.

Here is where many regulated organisations are missing a critical compliance link: the new complaints-handling obligations create new document retention requirements.

When a data protection complaint is received, organisations must retain all records relating to that complaint — including the original complaint, investigation notes, correspondence, and outcome decisions — for a sufficient period to demonstrate compliance if challenged by the ICO.

This means:

1. Retention Schedules Must Be Updated

Your existing document retention policy almost certainly predates the DUAA's June 2026 commencement. It must now account for:

• Complaints records and their associated processing activities
• DSAR (Data Subject Access Request) response records, which now must include signposting to the new complaints right
• Privacy notice version histories, demonstrating when updates were made

2. Destruction Timelines Must Be Reviewed

The GDPR's storage limitation principle — that personal data should only be kept as long as necessary — remains in full force. But "necessary" now includes the period during which a complaint could be raised, investigated, or escalated to the ICO.

For UK regulated industries, this creates a layered retention obligation:

• Financial services (FCA-regulated firms): Financial records must be retained for specified periods (typically 5–7 years), but complaints records may need to be held longer if regulatory proceedings are ongoing
• Healthcare (NHS/CQC-regulated): Patient data complaints records intersect with clinical record retention requirements — a complex compliance matrix
• Legal sector: Solicitors must balance client confidentiality obligations with the new transparency requirements around complaints handling

3. Secure Destruction Is Now More Visible

Because complaints-handling records are now auditable by the ICO, the way you destroy them matters more than ever. Inadequate disposal — such as leaving paper records in unsecured bins or using office shredders that don't meet required particle size standards — could constitute a GDPR violation in its own right.

Under BS EN 15713:2023, the gold standard for secure information destruction in the UK, organisations should ensure:

• Secure collection of confidential material
• Screened and vetted personnel handling sensitive data
• Certificates of Destruction issued for all destroyed materials
• Full audit trail maintained

The ICO's enforcement activity in 2026 demonstrates that regulators are not holding back. Recent penalties include:

• Reddit, Inc. — £14,472,500 (February 2026) for unlawful processing of children's data
• South Staffordshire Water — £963,900 (May 2026) for a cyber incident exposing 633,887 data subjects
• KRA Consultancy Ltd — £300,000 (May 2026) for unsolicited direct marketing

Globally, GDPR fines have now surpassed €7.1 billion in cumulative penalties since 2018, with approximately €1.2 billion imposed in the most recent 12-month period alone — confirming that high-value enforcement is now the norm, not the exception.

For UK regulated industries, the message is unambiguous: the cost of non-compliance far exceeds the cost of getting compliant.

Action 1: Audit Your Complaints-Handling Infrastructure

Map every channel through which a data protection complaint could arrive — email, phone, in-person, social media. Ensure each is captured, logged, and routed to the appropriate compliance function.

Action 2: Update Your Document Retention Policy

Add a specific section covering DUAA complaints records. Define retention periods, responsible owners, and destruction timelines. Ensure this policy is reviewed at least annually.

Action 3: Review Your Privacy Notices

Your privacy notice must now explicitly inform individuals of their right to raise a data protection complaint with your organisation, how to do so, and their continuing right to escalate to the ICO.

Action 4: Implement Certified Secure Destruction

Partner with a BS EN 15713:2023-certified shredding provider to ensure all physical documents — including complaints records at end of retention — are destroyed securely with Certificates of Destruction issued.

Action 5: Train Your Teams

Every member of staff who could receive a data protection complaint — from frontline customer service to HR to legal — must understand what constitutes a complaint, how to recognise it, and how to escalate it appropriately.

Financial Services

FCA-regulated firms face a dual compliance burden: FCA conduct rules require robust complaints-handling processes, and the DUAA now adds a parallel data protection complaints regime. Firms should ensure their existing FCA complaints infrastructure is adapted to capture data protection complaints as a distinct category.

Healthcare

NHS trusts, GP surgeries, and private healthcare providers must integrate the new complaints-handling requirements with existing patient rights frameworks. The DUAA's provision allowing NHS trusts to access patient records across organisations adds further complexity to data retention and destruction decisions.

Legal Sector

Solicitors and law firms hold some of the most sensitive personal data in any sector. The new complaints regime intersects with professional conduct obligations under the SRA. Firms should review their data protection complaints process as part of their broader risk management framework.

Banking

Banks and building societies already operate under stringent FCA and PRA oversight. The DUAA's complaints-handling requirements add a new layer of accountability that must be embedded into existing compliance frameworks — particularly around customer data retention and secure disposal.

The June 2026 DUAA commencement was not a finish line — it was a starting gun. For UK regulated industries, the combination of new complaints-handling obligations, updated retention requirements, and the ever-present risk of ICO enforcement means that data protection compliance must be treated as a continuous, evolving process.

Secure document destruction is no longer just a back-office function. It is a visible, auditable component of your organisation's accountability framework — and one that regulators will scrutinise.

The time to act is now.

• ICO: How to deal with data protection complaints (June 2026)
• ICO: The Data Use and Access Act 2025 — what does it mean for organisations?
• Restore Datashred: Laws and Requirements for Shredding & Document Destruction
• ICO Enforcement Actions 2026
• Employment Law Worldview: The DUAA 2025 — what employers need to do from 19 June 2026

Published: 15 August 2026 | Author: Venture Waste Compliance Team | Target Audience: UK Finance, Legal, Banking & Healthcare Professionals