ICO Complaint Response Navigator for SMBs

The situation

Tom, 45, runs a 12-person lettings agency in Manchester. A former tenant SAR'd the agency in March; the office manager half-answered it, missing emails and the tenancy file notes. The tenant complained to the ICO, which has now written asking the agency to explain its SAR handling and respond within three weeks. Tom's solicitor does conveyancing, not data protection; a DPO consultancy quotes £2,800. What Tom doesn't know: the ICO closes most first-time SMB cases with "advice given" if the response shows competent remediation, a late-but-complete SAR fulfilment now, with proper third-party redactions, plus dated process fixes, usually ends the matter; a defensive or vague reply is what escalates it; and under the Data (Use and Access) Act 2025 he was supposed to have a complaints procedure all along, installing one now is both remediation evidence and future protection.

Who receives this

UK SMBs (5–50 staff) that hold consumer or employee data and receive ICO correspondence, lettings/estate agencies, recruiters, clinics, e-commerce, gyms, nurseries. Secondary: bookkeepers/IT MSPs fielding the letter for clients; micro-DPO consultants (pro tier).

Why the agency will not advise you

The ICO cannot coach an organisation on responding to the ICO's own investigation, its small-org hub explains duties in the abstract. Enterprise DSAR platforms ignore the segment; consultancies price 20–50x the tool. The DUAA 2025 complaints-procedure duty is brand-new, statutory, and unknown to SMBs, a compliance hook that converts the one-time rescue into a recurring relationship.

Key facts, with sources

• The UK Data (Use and Access) Act 2025 introduces statutory data protection complaints requirements: controllers must give data subjects a means of complaining directly, acknowledge complaints within 30 days, take appropriate steps to investigate and respond without undue delay, and inform complainants of outcomes, converting complaint handling into a legal duty for every UK controller including SMBs. Source: UK ICO explains the Data (Use and Access) Act's new data protection complaints requirements — Osborne Clarke · How do we prepare to handle data protection complaints? — ICO
• Subject access requests must be answered within one calendar month (extendable for complex requests), with reasonable and proportionate searches, SAR failures are the highest-volume complaint type reaching the ICO from small organisations, and the ICO publishes step-by-step small-org guidance that explains the duty but does not prepare an organisation's response to an ICO investigation. Source: How to deal with a request for information: a step-by-step guide — ICO (advice for small organisations) · A guide to subject access — ICO
• The ICO's public-facing complaint route actively channels individuals to complain first to the organisation and then to the ICO, sustaining a steady flow of ICO letters to small organisations, whose only professional recourse today is DPO consultancies at £1.5k–£5k or enterprise privacy platforms priced for corporates. Source: How to make a data protection complaint to an organisation — ICO · ICO Inaction on SAR Complaints: the high bar for intervention — Legal Lens

When to bring in a professional

Self-serve responses fit routine cases: clear facts, amounts a business can absorb, and a deadline still ahead of you. Bring in a licensed professional when the amount at stake is large relative to their fee, the facts are genuinely disputed, criminal exposure is possible, or the deadline has already passed. A short paid consultation to sanity-check your plan is often worth it even when you handle the filing yourself.

All sources for this guide

1. UK ICO explains the Data (Use and Access) Act's new data protection complaints requirements — Osborne Clarke
2. How do we prepare to handle data protection complaints? — ICO
3. How to deal with a request for information: a step-by-step guide — ICO (advice for small organisations)
4. A guide to subject access — ICO
5. How to make a data protection complaint to an organisation — ICO
6. ICO Inaction on SAR Complaints: the high bar for intervention — Legal Lens