Jira & Confluence 
Bitrix24 UK GDPR · Data Protection Act 2018 s.164A · applies across the UK
Your data caught up in a company's breach? — complaint and access request ready
Short answer. The letter to the company is open below: it complains under the new section 164A and asks for a copy of your data. Your right to complain to the company: You may complain to the controller about an infringement of the UK GDPR relating to your data (Data Protection Act 2018, s.164A(1) (in force 19 June 2026)).
- Last day for the company to acknowledge your complaint (30-day period beginning on the day of receipt): type the date
- Copy of your data due — one month beginning on the day of receipt (treat the day before this date as the safe deadline): type the date
- Longest possible extension for a complex access request — two further months, only if the company tells you within the first month: type the date
Check your own case.
Since 19 June 2026 a controller must acknowledge a data protection complaint within the period of 30 days beginning when it is received, then respond without undue delay and tell you the outcome (Data Protection Act 2018, s.164A(3)–(4)). An access request must be answered within one month beginning with the relevant time, usually the day the request is received; the company may extend by two further months for complex or numerous requests, but must tell you and give reasons within the first month (UK GDPR, Art. 12(3) and Art. 12A). If the company asks you for identity information or a fee, the month starts when it receives them.
Start typing right in the document — no sign-up. It stays in this browser; save it to your free Layers account to keep it, open it on your phone and share it.
Lida, Layers template assistant
Tell me the date the company received your letter, and I will show you the acknowledgement and data deadlines.
Write down every suspicious e-mail or call since the breach with its date. That list is your evidence.
An illustrated character, not a lawyer.
Deadlines
The rules, with the source
| What | Deadline | Source |
|---|---|---|
| Your right to complain to the company | You may complain to the controller about an infringement of the UK GDPR relating to your data | Data Protection Act 2018, s.164A(1) (in force 19 June 2026) |
| Acknowledgement of your complaint | Within the period of 30 days beginning when the complaint is received | DPA 2018, s.164A(3) |
| Handling and outcome | Without undue delay: take appropriate steps, inform you of progress and the outcome | DPA 2018, s.164A(4)–(5) |
| Copy of your data (access request) | One month from the relevant time; up to two further months for complex requests, with notice and reasons within the first month | UK GDPR, Art. 15, Art. 12(3), Art. 12A |
| Telling you about the breach | Without undue delay where the breach is likely to result in a high risk to you, in clear and plain language | UK GDPR, Art. 34(1)–(2) |
| Compensation | Right to compensation for material or non-material damage caused by an infringement | UK GDPR, Art. 82(1) |
Applies to companies and organisations across the UK. Complain to the company first; the Information Commissioner's Office is the next step if you are not satisfied.
Step by step
What to do, in order
1
Find the company's privacy contact
Look in its privacy notice for the data protection officer or a complaint form.
2
Describe what you know
The date you learned of the breach, what data, and any suspicious messages since.
3
Keep or delete the access request
Point 4 asks for a copy of your data. Keep it if you want to know exactly what was taken.
4
Send it and note the date
Use e-mail or the company's form. The deadlines run from the day it is received.
5
Check the dates above
Acknowledgement within 30 days, your data within one month.
6
Escalate if needed
No proper answer? Complain to the Information Commissioner's Office, attaching this letter and the reply.
Questions
What changed in 2026?
Since 19 June 2026 the Data Protection Act 2018 gives you a direct right to complain to the company, which must acknowledge your complaint within 30 days and then deal with it without undue delay.
How long does the company have to send me my data?
One month from receiving your request (or from receiving any information it reasonably asked you for). It can extend by two further months only for complex or numerous requests, and must tell you why within the first month.
Can I get compensation?
The UK GDPR gives a right to compensation for material or non-material damage caused by an infringement. Whether you get it, and how much, depends on your facts; keep evidence of any loss, time spent and distress.
Official sources
Other documents
Keep the papers in one place
Letters, receipts and notices in one folder you can share with family or a lawyer. The templates and the editor are free; Layers is free for up to 20 people.
This is a ready document and a deadline calculation, not legal advice.