Data Protection Act 2018UK · 2018 c. 12
Digiphile
Data Protection Act 2018 (c. 12) – Section 165 – Complaints by data subjects to the Commission

Sections

Section 165Complaints by data subjects [F1to the [F2Commission]]

(1) F3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(2) A data subject may make a complaint to the [F4Commission] if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of [F5the UK GDPR or] Part 3 or 4 of this Act.
(3) The [F4Commission] must facilitate the making of complaints under subsection (2) by taking steps such as providing a complaint form which can be completed electronically and by other means.
(4) If the [F4Commission] receives a complaint under subsection (2), the [F4Commission] must—
  • (a)
    take appropriate steps to respond to the complaint,
  • (b)
    inform the complainant of the outcome of the complaint,
  • (c)
    inform the complainant of the rights under section 166, and
  • (d)
    if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.
(5) The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes—
  • (a)
    investigating the subject matter of the complaint, to the extent appropriate, and
  • (b)
    informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with [F6a] foreign designated authority is necessary.
(6) F7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(7) In this section—
  • “foreign designated authority” means an authority designated for the purposes of Article 13 of the Data Protection Convention by a party, other than the United Kingdom, which is bound by that Convention;
  • F8...

Amended text

This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Conditional amendment with no effect

legislation.gov.uk still lists the following conditional amendment(s) to this Section as not yet made. They have no effect, so the text above is not affected:

  • s. 165(1): word substituted by S.I. 2026/386, Sch. 2, para. 23(2), (3) (NB: conditional amendment: if 2025 c 18, s. 103 is fully brought into force before s. 119 is fully brought into force, this amendment has no effect); commencement: reg. 1(2)

Note: This amendment has no effect: under reg. 1(4) of S.I. 2026/386 it falls away because section 103 of the Data (Use and Access) Act 2025 was fully brought into force (19 June 2026, S.I. 2026/82, reg. 3(a)) before section 119 (30 September 2026, S.I. 2026/1015, reg. 2).

Annotations

Textual Amendments

  1. F1 Words in s. 165 heading inserted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 19; S.I. 2026/82, reg. 3(b) (with reg. 7)
  2. F2 Word in s. 165 heading substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3) (with reg. 1(5)); S.I. 2026/1015, reg. 2(c)
  3. F3 S. 165(1) omitted (19.6.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 103(3)(a), 142(1); S.I. 2026/82, reg. 3(a) (with reg. 7)
  4. F4 Word in s. 165(2)-(4) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  5. F5 Words in s. 165(2) inserted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 103(3)(b), 142(1); S.I. 2026/82, reg. 3(a) (with reg. 7)
  6. F6 Word in s. 165(5)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 66(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  7. F7 S. 165(6) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 66(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  8. F8 Words in s. 165(7) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 66(5) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement Information

  1. I1 S. 165 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

https://dpa2018.digiphile.law/article/article-165.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.

Type to search the full text.