Registered housing providers, are you ready for the Data (Use and Access) Act 2025?

Data protection is changing the way that registered housing providers (RPs) are legally obliged to receive, investigate and resolve housing complaints.

Following reforms such as Awaab’s Law, the updated Consumer Standards and the Complaint Handling Code, the newly introduced Data (Use and Access) Act 2025 (DUA Act) requires that all data protection complaints are handled internally – swiftly, transparently and accessibly. Specifically, the DUA Act amends the Data Protection Act 2018, with the addition of Section 164A, requires organisations to have a formal process for handling data-related complaints.

So how can RPs ensure their data protection complaint-handling procedures are compliant?

1. Have a clear understanding of the Information Commissioner’s Office (ICO) guidelines
2. Carry out an audit of your current complaints handling procedures
3. Train relevant team members
4. Respond to data complaints in an effective and justified manner

Familiarise yourself with ICO guidelines

To ensure social landlords are prepared when implementing a data protection complaints process, the ICO has developed guidelines which are available to access through the ICO.

The ICO guidelines provide a template for an accessible complaints submission form and suggest an acceptable timeframe for processing a complaint. RPs must provide electronic and physical written forms, online portals, live chats, or the option to submit a complaint over the phone and acknowledge receipt of data within 30 days of a complaint being made.

To ensure the timely and efficient handling of a complaint, RPs should avoid over-engineering processes, especially with regard to identity verification. Proof of identity is required to initiate an investigation and this should also apply to solicitors making enquiries on behalf of an RP. Identification is only required on the first instruction, not for every interaction.

Audit existing processes

When looking to revise complaint-handling processes, RPs should begin by auditing existing complaint-handling frameworks. This enables teams to identify areas where they can align procedures and optimise processes to include data grievances. Where this is not possible, RPs should follow the ICO guidance and design and implement a new open and accessible submission form. For example, this form could mirror that used for subject access requests, which RPs should already be familiar with.

Train your team

Once procedures have been audited and revised, proper training will be essential. The introduction of Section 164A in the DUA Act means that some providers may not have had to handle data protection complaints previously. Training is essential for those responsible for managing and overseeing data protection – whether that is carrying out the investigation themselves or seeking the support of data governance teams with the necessary technical expertise.

Responding to complaints

The ICO can also guide how to respond to data complaints in an effective and justified manner, specifically how to demonstrate the steps that have been taken to resolve the complaint. Providers should be clear when communicating with complainants, both throughout the investigation procedure and when justifying the outcome. Teams should be aware that once the complaint has been closed, the complainant has no right to internal review and will have to escalate the matter to the ICO if they wish to take matters further. 

It is important to note that once the complaint submission has been acknowledged, there isn’t a set timeframe for the investigation to be carried out. It is best practice, however, to align with other expectations under the Social Housing Act 2023 and the Housing Ombudsman’s Complaint Handling Code. For example, the Code states that after receipt of an acknowledgement, an initial response should be sent within 10 working days and a final response 20 working days thereafter.

Key takeaways

Social landlords have 12 months to implement the new data protection complaints handling procedures. To get started, they should consider the following:

1. Review current complaints handling procedures – what needs to be done to comply with new data protection requirements?
2. Ensure thorough training is given across the business
3. Follow up with the ICO for its updated guidelines

For advice and support with the Data (Use and Access) Act 2025, please contact Ben Pumphrey.