Data Protection Act 2018, section 165

Complaints by data subjects to the Commission

PART 6 Enforcement

F705(1). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(2)A data subject may make a complaint to the [F706CommissionF706] if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of [F707the UK GDPR orF707] Part 3 or 4 of this Act.

(3)The [F706CommissionF706] must facilitate the making of complaints under subsection (2) by taking steps such as providing a complaint form which can be completed electronically and by other means.

(4)If the [F706CommissionF706] receives a complaint under subsection (2), the [F706CommissionF706] must—

(a)take appropriate steps to respond to the complaint,

(b)inform the complainant of the outcome of the complaint,

(c)inform the complainant of the rights under section 166, and

(d)if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.

(5)The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes—

(a)investigating the subject matter of the complaint, to the extent appropriate, and

(b)informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with [F708aF708] foreign designated authority is necessary.

F709(6). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(7)In this section—

  • “foreign designated authority” means an authority designated for the purposes of Article 13 of the Data Protection Convention by a party, other than the United Kingdom, which is bound by that Convention;

  • F710 ...

Definitions used in section 165 1

foreign designated authority

10 In this Part of this Schedule, “foreign designated authority” means an authority designated for the purposes of Article 13 of the Data Protection Convention by a party, other than the United Kingdom, which is bound by that Data Protection Convention.

Defined in Sch.14 para.10 · see it in the full Act

Cases considering section 165 7

Ben Peter Delo, R (on the application of) v The Information Commissioner

[2023] EWCA Civ 1141 · 10 October 2023Interprets

Interprets: the complaint provisions for Parts 3 and 4 adopt the GDPR terminology and provide no independent support for a merits-determination duty under Article 77. (see paras [22]; [54]; [78]) Cited only. Confirms: Parliament placed section 165(2) complaints on a footing comparable to Article 77 complaints and did not specify a conclusive merits determination. (see paras [22]; [54]; [78]) Cited only. Cited only. Cited only.

Dr Michael Guy Smith v Information Commissioner

[2025] UKUT 74 (AAC) · 28 February 2025Interprets

Interprets the statutory obligation to take appropriate steps in response to a complaint, including investigation to the extent appropriate and provision of progress information. The provision forms the basis for the procedural remedy in section 166 (see paras [40]-[43]).

Jennifer Webster v The Commissioners for HMRC

[2024] EWHC 530 (KB) · 8 March 2024

The court identified the right to complain to the Information Commissioner as an alternative regulatory remedy relevant to the claimant’s pre-action conduct and HMRC’s waiver argument. (see paras [20], [21], [89])

What each judgment says about section 165 is in the case-law panel in the full Act.

Amendments and notes

9 notes from legislation.gov.uk

Amendments

  1. F703Words in s. 165 heading inserted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 19; S.I. 2026/82, reg. 3(b) (with reg. 7)
  2. F704Word in s. 165 heading substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3) (with reg. 1(5)); S.I. 2026/1015, reg. 2(c)
  3. F705S. 165(1) omitted (19.6.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 103(3)(a), 142(1); S.I. 2026/82, reg. 3(a) (with reg. 7)
  4. F706Word in s. 165(2)-(4) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  5. F707Words in s. 165(2) inserted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 103(3)(b), 142(1); S.I. 2026/82, reg. 3(a) (with reg. 7)
  6. F708Word in s. 165(5)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 66(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  7. F709S. 165(6) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 66(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  8. F710Words in s. 165(7) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 66(5) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement

  1. I172S. 165 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)