New data protections rules coming in today

New data protection rules regarding customer complaints are coming in today (19^th June).

The Data (Use and Access) Act 2025 now requires you to have a data protection policy for handling complaints about the use of people's personal data, meaning you must be clear about the process – and the timeframe in which issues will be dealt with.  

The new rules make it mandatory to:

1. Provide a way for people to make complaints about the use of their data. The easiest way to achieve this is to provide an email address for people to submit complaints.
   The NRLA privacy notice template has always included this information, so if you use it already you are compliant with this element of the legislation.
2. Inform people that they may complain to the ICO. The NRLA privacy notice template has always included this information, so, again, if you use our privacy notice, you are already compliant.
3. Acknowledge receipt of a complaint within 30 days. You are not required to resolve the complaint within 30 days, but you must respond to confirm receipt. If the complaint is made via email, then an auto-acknowledgement email is sufficient to meet this requirement in most cases. 
4. Investigate and address the complaint within a reasonable amount of time. What is a reasonable timeframe will generally depend on the complexity of the complaint and the number of staff you need to speak to. 

Remember, in practice, complaints about data protection are rare within the private rented sector, and we do not expect many landlords to have to handle these complaints on a regular basis, but you do need to be prepared.

Investigating a complaint

Once you have received a complaint, you should take reasonable steps to investigate whether the complaint is accurate. This will usually involve:

• Checking you have all the information you need to investigate. Ask for as much information as possible from the complainant. You should also speak to any of your staff that may be involved to gather relevant information from them.
• Investigating promptly.  Once you have all the information you need start your investigation. immediately. Check the accuracy of the complaint by comparing it with the information you hold, and your privacy notice. 
• Inform the complainant of the outcome and any delays. Ideally you should aim to respond in full to the complaint within 30 days. If this is not possible it is vital you keep the complainant informed about the progress of the investigation.
• Record your actions. Keep records of everything, from the date and nature of the complaint, to acknowledgment, documents and conversations. You should also record the outcome of the investigation and action taken.

Do I need a written complaints policy?

While it is not mandatory, if you are a larger organisation, you may want to write out a more detailed complaints policy recording how you approach a data complaint. In general this isn’t necessary for most smaller landlords, provided they provide contact details for a complaint, and acknowledge them promptly.

Do I need a complaints form or specific tools?

No, as long as you acknowledge receipt of the complaint and investigate and document a complaint appropriately.

How do I handle complaints via social media?

If you use social media and a person complains to you on there, then this will still count as a complaint, and you must acknowledge it. However, rather than responding on social media, it will usually be best to ask them to provide an alternative contact address (such as email) to allow you to get in contact with them privately.

What should I do if I'm not sure whether a complaint is being made?

In most cases, it will usually be clear if a complaint is being raised. If you are unclear as to whether the person is raising a complaint, then you should ask them to clarify.

More information

• For more information on all your GDPR obligations click here.
• The NRLA runs a training course on General Data Protection Regulation (GDPR) training course for Landlords and Agents. For more information and to book click here.