The key ICO complaints statistics in one place — how many data protection complaints the UK regulator receives, how long it takes to respond, what the outcomes are, which sectors attract the most complaints, and what the new statutory complaints duty that took effect in June 2026 means, with the data period stated next to every figure.
People can complain to the Information Commission’s Office (ICO) about how an organisation has handled their personal data. Its annual report measures incoming complaints and outcomes, while published quarterly CSV files describe completed cases. This page keeps those measures separate and explains the complaints rules introduced by the Data (Use and Access) Act 2025.
It is scoped to public complaints and how the ICO handles them. Complaints are a different series from the personal data breach reports organisations submit about themselves — tracked on our data breach statistics page — and from enforcement outcomes such as fines and reprimands, which our GDPR fines statistics page covers. Every figure below carries its data period, and every source is linked in full at the end.
Key facts and figures
- 76,743 data protection complaints were received by the ICO in 2025/26 — up 81% from 42,315 in 2024/25.
- 62,211 complaint outcome decisions were issued in 2025/26, up from 36,196 a year earlier.
- 72.6% of complaints in 2025/26 were not assessed and responded to within the ICO’s 90-day target, compared with 70% in 2024/25.
- 31,321 complaints were open at 31 March 2026 — up 98% from 15,810 a year earlier.
- 24,132 unique completed complaint cases appear in the published Q1 2026/27 extract, covering April–June 2026.
- 48.6% of those published completed cases had an Article 15 right-of-access provision recorded as the primary issue.
- 83% of complaint outcomes in the 2025/26 annual report were categorised as advice given, no further action; 17% involved informal action.
- 30 days is the new statutory deadline for organisations to acknowledge a data protection complaint, in force since 19 June 2026.
Figures were checked on 15 October 2026. The annual comparison uses the ICO’s 2025/26 report; detailed complaint reasons and sectors use its published Q1 2026/27 completed-case extract. These are different reporting series.
How many complaints does the ICO receive each year?
The ICO received 76,743 data protection complaints in 2025/26, compared with 42,315 in 2024/25, an increase of 81%. It issued 62,211 complaint outcome decisions, compared with 36,196. Incoming complaints therefore exceeded outcome decisions, although case reclassification means these measures should not be used as a simple reconciliation of the open caseload.
The 2025/26 total is substantially above the 45,000–55,000 annual range discussed in the ICO’s 2025 consultation. The published annual result is now the useful measure for assessing demand.
| Measure | 2024/25 | 2025/26 | Change |
|---|---|---|---|
| Data protection complaints received | 42,315 | 76,743 | +81.4% |
| Complaint outcome decisions issued | 36,196 | 62,211 | +71.9% |
| Complaints not assessed and responded to within 90 days | 70% | 72.6% | +2.6 percentage points |
| Open complaints at year end | 15,810 | 31,321 | +98.1% |
All four rows use the ICO Annual Report 2025/26, including its comparative figures for 2024/25. Complaint receipts, outcomes and open cases are distinct measures; movements between case classifications can affect the totals.
A quick note on what this series is not. Complaints from the public are separate from the self-reported personal data breach notifications organisations must file with the ICO — those volumes and sector breakdowns are tracked on our data breach statistics page. And a complaint is not an enforcement action: fines, reprimands and enforcement notices are counted on our GDPR fines statistics page.
How long does the ICO take to respond to a complaint?
In 2025/26, the ICO assessed and responded to 27.4% of complaints within 90 days against its 80% target. The corresponding miss rate was 72.6%, compared with 70% in 2024/25. These annual performance measures are not an estimate of the waiting time for a complaint submitted today.
Open complaint cases increased from 15,810 at 31 March 2025 to 31,321 at 31 March 2026, a rise of 98%. The annual report also shows that 69.5% of complaints were assessed and responded to within six months, compared with 98.4% in 2024/25.
The ICO now triages complaints under its published data protection framework. Some receive a light-touch review and are recorded for information, while complaints requiring further enquiries are allocated to a case officer. A complaint does not automatically lead to a full investigation.
The framework considers matters such as likely harm, effects on people needing extra support, the number of people affected and whether further enquiries could improve data protection. These criteria explain how the regulator prioritises its resources.
What are the most common outcomes of an ICO complaint?
In the ICO Annual Report 2025/26, 83% of complaint outcomes were categorised as advice given, no further action and 17% as informal action taken. The corresponding 2024/25 split was 67% and 33%.
No further action does not necessarily mean that the complaint was unfounded or that the organisation complied with every requirement. The ICO may record a complaint without further enquiries, consider existing remedial steps sufficient, or use the information to identify wider patterns. Formal enforcement is reported separately from these complaint outcomes.
The latest detailed extract available for this review contains 24,132 unique complaint cases completed in April–June 2026. Published case extracts and annual operational totals have different coverage and may be revised; the extract should not be treated as a count of complaints received in that quarter.
What do people complain to the ICO about?
Article 15 right-of-access provisions were the recorded primary issue in 11,731 of the 24,132 published cases completed in Q1 2026/27: 48.6%. This calculation includes every Article 15 subcategory, rather than only the general right-of-access and copy-of-data codes.
This makes subject access a substantial part of the published completed-case workload. The category records the complaint issue, not a finding that the organisation broke the law. Our subject access request statistics page explains the calculation and the current handling rules.
Which sectors are most complained about?
Online technology and telecoms had the largest count among the published completed cases in Q1 2026/27, with 2,828. Health followed with 2,632, finance, insurance and credit with 2,499, and general business with 2,449. These are volumes, not rates adjusted for sector size or numbers of customers.
| Rank | Sector | Published completed cases (Q1 2026/27) | Share of 24,132 published cases |
|---|---|---|---|
| 1 | Online technology & telecoms | 2,828 | 11.7% |
| 2 | Health | 2,632 | 10.9% |
| 3 | Finance, insurance & credit | 2,499 | 10.4% |
| 4 | General business | 2,449 | 10.1% |
Together these four sectors account for 43.1% of the published completed cases. Differences in sector size, public contact, reporting and case completion affect the ranking, so it cannot establish which sector is least compliant.
What changed on 19 June 2026? The new complaints duty
Since 19 June 2026, controllers must facilitate data protection complaints, including by providing an electronic means, and acknowledge them within 30 days. They must take appropriate steps to respond without undue delay and keep the complainant informed. The 30-day period is for acknowledgement, not a universal deadline for resolving the complaint.
The duty is in section 164 A of the Data Protection Act 2018, inserted by section 103 of the Data (Use and Access) Act 2025. The ICO’s current guidance explains the practical steps, including making complaints routes accessible and considering the circumstances of each complaint.
For organisations, this means a usable complaints route, a reliable acknowledgement process and staff who can recognise a data protection complaint. A data protection rights request follows its own deadline and should not be delayed merely because it arrives alongside a complaint.
How does the ICO’s current complaints framework work?
The ICO’s current framework assesses individual complaints and separately monitors patterns involving organisations. As checked on 15 October 2026, its organisational review threshold is 12 complaints within one month, reviewed quarterly. Reaching it triggers a focused review of available information, not automatic enforcement or a finding of non-compliance.
The threshold does not replace assessment of each individual complaint. The ICO considers harm, context and regulatory priorities when deciding whether more work is appropriate. It may record information without contacting the organisation, and complainants can request a review if they disagree with how their case was handled.
Frequently asked questions
How many complaints does the ICO receive each year?
The ICO received 76,743 data protection complaints in 2025/26, up 81% from 42,315 in 2024/25, according to its annual report. It issued 62,211 complaint outcome decisions during the year.
How long does the ICO take to respond to a data protection complaint?
The ICO’s target is to assess and respond to 80% of complaints within 90 days. Its 2025/26 result was 27.4%, with 69.5% assessed and responded to within six months. These annual results are not a promised waiting time for a new complaint.
What are the most common outcomes when you complain to the ICO?
The 2025/26 annual report categorised 83% of complaint outcomes as advice given, no further action and 17% as informal action taken. These categories should not be read as a finding that every complaint ending without further action was unfounded.
Do you have to complain to the organisation before going to the ICO?
The ICO recommends first giving the organisation an opportunity to put matters right. Since 19 June 2026, controllers have had a statutory duty to facilitate complaints, acknowledge them within 30 days and respond without undue delay. That acknowledgement period is separate from a subject access request deadline.
What do people complain to the ICO about most?
Article 15 right-of-access provisions were the primary issue in 11,731 of 24,132 published cases completed in Q1 2026/27, or 48.6%. The calculation includes all Article 15 subcategories and measures completed cases rather than new complaints.
Related guides
- Subject access request statistics UK: volumes, deadlines and complaints
- GDPR Fines UK: ICO Fine & Enforcement Statistics
- Data Breach Statistics UK: ICO Reports, Trends & Costs
- Individual rights under GDPR: a complete guide to data subject rights
- GDPR fines and penalties in the UK: how big, who pays, what counts
Sources & references
- ICO — Annual Report and Financial Statements 2025/26
- ICO — published data protection complaint cases completed in Q1 2026/27
- ICO — complaints data and methodology
- ICO — current data protection complaints framework
- ICO — how to deal with data protection complaints
- Data (Use and Access) Act 2025, section 103
Most ICO complaints start with an everyday handling failure — train your team to deal with personal data and data protection complaints properly under UK GDPR.
Explore the GDPR & Data Protection Course →
Mark writes about data protection, workplace compliance and accredited online training for GDPR & Data Protection Course, part of Online CPD Academy.