Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what assessment her Department has made of the adequacy of the timeliness of the Information Commissioner's Office in investigating complaints concerning the handling of special category health data.

While DSIT acts as the ICO's sponsor department within government, the ICO is an independent regulator accountable to Parliament. The ICO has a statutory duty to investigate complaints from data subjects to the extent appropriate and reports annually to Parliament on its approach to complaints and investigations.

The ICO does not publish complaint handling times by category of personal data. However, it triages all complaints based on the level of harm that alleged non-compliant practices may pose to data subjects.

To address its backlog, the ICO has introduced a new data protection complaints framework setting out how it assesses and prioritises each case. In addition, the Data (Use and Access) Act 2025 introduced a new requirement for all data controllers to establish procedures for responding to complaints, aiming to resolve issues at the earliest stage and reduce premature escalation to the ICO.