Since 19 June 2026 the Data (Use and Access) Act 2025 has given people the right to complain directly to an organisation about how it handles their personal data, and the organisation has to tell them that right exists. The privacy notice is where they are told. Plenty of privacy notices were written for GDPR in 2018 and have not been opened since. Try a quick test on yours: search it for "complain" and then for "AI". If the first comes back empty, the notice is out of date. If the second does, it is worth asking whether that is because nobody uses AI, or because nobody has written it down.
Privacy Notice Complaints - What Changed in June
There has to be a route for data protection complaints, and complaints can arrive by any channel, in plain words. Each one has to be acknowledged within 30 days, looked into without undue delay, and the person told what was found and what was done about it. People have to be told about the right when their data is collected, which means the privacy notice, and again when you reply to a request to exercise their rights.
A privacy notice that only says "you can complain to the ICO" no longer covers it. The ICO, which became the Information Commission on 30 September and still trades under the old name, now expects you to be the first stop.
AI and Your Privacy Notice
Last month we wrote about AI missing from the personal data register: companies with an AI policy and acceptable use rules, and a Record of Processing Activities (RoPA) that does not mention AI anywhere. Customer details pasted into a chatbot, meetings turned into transcripts, chat logs held by a vendor, none of it written down.
A privacy notice is written from the register. If AI is missing from the RoPA, it is missing from the privacy notice too, and the people whose data is going into those tools are the ones being told nothing about it. They are also the people who now have a right to complain to you.
Updating Your Privacy Notice
Start with the register, because the notice should follow it. Then add two sections. The first is how to complain: who to contact, that you will acknowledge within 30 days, what happens next, and the ICO as the place to go if they are still not satisfied. The second is how you use AI: which tools, what personal data they see, and whether anything shared with them is used to train the provider's models. Check the process behind the words too: someone has to pick a complaint up and record when it arrived, when it was acknowledged and what the outcome was.
We rewrote our own privacy policy in September. It explains which AI tools are used when preparing documents and what they do with personal data, and it sets out the complaints route: tell us first, an acknowledgement within 30 days, and the ICO if you are still not satisfied.
In alphaZ documents, the P-26 Privacy Policy template includes sections for how AI is used and for complaints, and the P-84 Website Privacy Policy covers website visitors, including chatbot conversation logs. Both are part of the GDPR / Data Protection Toolkit. If you would rather have it done for you, Personal Data Register and Privacy Notice Preparation is a remote support service that prepares the register and writes the privacy notices from it, AI included.
Legal and Compliance Obligations for UK Businesses
UK GDPR and Data Protection Act 2018 Compliance for Businesses
GDPR / Data Protection Toolkit
Personal Data Register and Privacy Notice Preparation
Published: 13 October 2026
