EA Bulletin: 395 Scotland

Data (Use and Access) Act – New requirement for data protection complaints process

New provisions relating to the handling of data protection complaints will be coming into force on 19 June 2026. These new rules apply to Electoral Registration Officers (EROs) and Returning Officers (ROs) in their role as data controllers.

The Information Commissioner’s Office has issued guidance to support data controllers to prepare for the new requirements. In summary, it states that all data controllers must:

  • Give individuals a way of making data protection complaints.
  • Acknowledge receipt of the complaint within 30 days of receiving it.
  • Undertake enquiries, keep individuals informed, and take appropriate steps to respond to complaints without undue delay.
  • Notify complainants of the outcome without undue delay.

We are updating our data protection guidance for EROs and ROs to reflect these new requirements and will confirm via a future EA Bulletin when these changes have been made. If you have any queries or need any further support, please contact the Scotland team at [email protected].