30 days to acknowledge a client's complaint about AI notes

A client emails your practice manager on a Friday evening. They have read their session summary, it says something they never said, and they want to know whether an AI wrote it and who else has seen it. Until this summer, you could treat that as a customer-service matter. Since 19 June 2026 it can also be a data protection complaint to you as controller, with a 30-day acknowledgement deadline (DLA Piper, June 2026).

We could not open the ICO's own pages or the Act from the environment this article was written in, so what follows is drawn from law-firm summaries of the statute and the ICO guidance, each named where it is used. Check the wording on the ICO site before you finalise your own procedure.

What changed on 19 June 2026

Section 103 of the Data (Use and Access) Act 2025 inserted a new section 164A into the Data Protection Act 2018. It gives individuals a statutory right to complain directly to a controller about an alleged failure to comply with the UK GDPR, before they go to the ICO (DLA Piper, June 2026; Mayer Brown, February 2026). The commencement regulations, SI 2026/82, brought section 103 into force on 19 June 2026, and the controller duties apply only to complaints received on or after that date (legislation.gov.uk, as returned by our search in October 2026).

The ICO published its guidance, "How to deal with data protection complaints", on 12 February 2026 and updated it on 8 May 2026 (as reported in law-firm summaries, including Arnold & Porter, February 2026). Summaries of that guidance say the duties are these:

• Make it practical to complain, for example through a web form or a dedicated email address.
• Acknowledge the complaint within 30 days of receiving it.
• Investigate it to an appropriate extent and tell the complainant the outcome without undue delay.
• Accept complaints however they arrive, including by phone, in person or through social media.

One summary says the ICO has indicated there are no exemptions, which would include a two-room private practice. We found that in a single source, so treat it as likely rather than settled. Another commentary says a written complaints procedure is recommended rather than mandatory. Both points are worth confirming against the guidance itself.

So what for you: you do not need to be large, or to have a data protection officer, for this to apply. If you decide how client records are processed, the duty is yours.

Why an AI scribe makes this more likely to reach you

Nothing in the new duty mentions AI. What an AI scribe changes is the number of things a client can reasonably ask about. A client who learns that a third-party tool recorded or summarised their session now has a fresh set of grievances: that they were not told, that the summary is wrong, that the recording went somewhere they did not expect. Each of those is a complaint about how their personal data was handled, and a complaint about how health data was handled lands squarely inside section 164A.

This is our reading, not guidance from the ICO. But the practical effect is easy to see. Most practices already have a clinical complaints policy, written around care. A client's complaint about an AI note may sit in both worlds at once: a clinical concern about accuracy, and a data protection complaint about processing. The clinical policy will not necessarily mention the 30-day acknowledgement, and the data protection duty will not wait for the clinical review to finish. One summary of the rules notes that the controller cannot hold back its outcome on the data protection complaint pending resolution of a wider complaint covering other matters (law-firm summary, 2026).

So what for you: decide now who opens the Friday evening email, how it is logged, and whether it is treated as a data protection complaint, a clinical complaint, or both.

Three routes a client can take, and the new first step

A client unhappy about AI-generated notes has more than one place to go. They can complain to you about the data handling, which is the new statutory route. They can complain to your regulator or professional body about your conduct, which is a separate process with its own rules. And they can still go to the ICO. One summary notes that section 103 also removed the older direct right in Article 77 of the UK GDPR to complain to the ICO, making section 164A the route (Bratby Law, 2026). Our reading is that the ICO is likely to expect to see what you did with the complaint first.

That ordering is the reason to build the process properly. A complaint handled promptly and in writing, with a clear explanation of what the scribe does and does not do, is the kind of record that makes the later stages shorter. A complaint that sat unacknowledged for six weeks is the opposite.

One summary also says that when you decline a rights request, such as a subject access request, you must tell the individual about their right to complain to you under section 164A as well as their right to complain to the ICO. Privacy notices should mention it too, according to the same summary. If your client-facing notice still describes only the ICO route, it is out of date.

So what for you: update the privacy notice and your standard rights-request reply templates so that both routes are named. It is a small edit with a visible compliance trail.

A one-page procedure that covers an AI complaint

You do not need a policy document of twenty pages. You need one page that someone other than the practice director can follow. Based on the duties above, it should hold six things:

1. An intake route. One monitored email address or web form, plus a rule that a complaint received by phone, in person or on social media is written up and logged the same day.
2. A named owner. The person who acknowledges, investigates and replies, and a deputy for when they are on leave.
3. A 30-day clock. Logged from the date of receipt, with an internal target well inside the deadline.
4. An AI question set. Which tool was used, what it recorded, where the data is held, who reviewed the note, and what the client was told and when.
5. A link to your DPIA and consent records. Your data protection impact assessment and consent paperwork are the evidence you will reach for first, so the complaints owner should know where they are kept.
6. An outcome letter template. It states what you found, what you will change, and the client's right to go to the ICO if they remain dissatisfied.

Item four is where AI-specific preparation pays off. If you cannot say, within a day, which version of the scribe produced a given note and who signed it off, the investigation will stall. Our piece on consent to AI in psychology practice covers what a client should have been told at the outset, which is the first thing a complaint will test.

So what for you: write the one-page procedure this month and run it once with a made-up complaint about an AI note. The gaps show up in the first ten minutes.

What we would do, and what we would not

The call: if you use an AI scribe in a private psychology practice, treat any client question about it as a possible section 164A complaint until you have read it twice. Acknowledge in writing within days rather than weeks, even when the answer is still being worked out. An early, plain acknowledgement costs almost nothing and removes the one failure the statute defines in numbers.

What we would not do is buy a complaints-management product for this. A shared mailbox, a log and a template cover the duty for a practice of this size. Frankly, the larger risk is not the tooling. It is the Friday evening email nobody saw until Wednesday.

So what for you: spend an hour on a shared mailbox, a log and a template reply, and spend your money elsewhere.

One limit on all of this: we have not seen any report of how the ICO is enforcing these duties since they began, and the guidance was updated in May 2026, so check for later changes. Where a practice would like an independent read of how its scribe set-up would stand up to a complaint, that is part of what the AI Opportunity and Growth Assessment examines, and a free 20-minute discovery call is the place to start.