Complia
A self-hosted complaints register with a 30-day acknowledgement timer for the UK Data (Use and Access) Act 2025.
The problem it solves
Section 103 of the UK Data (Use and Access) Act 2025 inserts a new duty into UK data-protection law: from 19 June 2026, every UK data controller must give data subjects a way to complain directly, must acknowledge each complaint within 30 days, and must respond substantively without undue delay. The ICO can require a record of the complaints you received and how you handled them.
Most small organisations currently handle this in an inbox and a spreadsheet, with no timer, no audit trail, and nothing to show the regulator.
What you get
Public complaint form
A no-login public form you link from your privacy notice; complainants get a private tracking code on submission.
Public status page
Complainants check progress with their tracking code — status only, no personal data exposed.
30-day acknowledgement timer
The admin register shows days-remaining and OVERDUE flags against the statutory acknowledgement window.
Status workflow with audit log
Move complaints through received, acknowledged, investigating, resolved, or rejected, with an append-only, timestamped investigation log per complaint.
Compliance dashboard
See open complaints, acknowledgements due within 7 days, overdue acknowledgements, and resolutions this month.
Audit CSV export
Export the full register, including status history, ready to hand to your DPO or the ICO.
Pricing — one-time, yours forever
Screenshots
Honest limitations
- Single-tenant: one organisation, one admin login per installation
- No built-in email sending (acknowledge complainants from your own mailbox; Complia records the timestamps)
- Not a case-management suite: no attachments, assignments, or SLA escalations
- English-language UI
- A records aid, not legal advice; buying it does not make you compliant
Two-minute web installer; PHP 8+ with MySQL or SQLite, standard shared-hosting compatible; Nginx snippet included.
Frequently asked questions
Does this make me DUAA-compliant?
No tool can claim that. Complia implements the record-keeping and acknowledgement mechanics the duty describes; your policies, responses, and legal position are yours. It's a documentation and records aid, not legal advice.
Is the 19 June 2026 deadline real?
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025, and the complaints-handling duty in s.103 was set to commence 12 months later. Verify the current commencement position on legislation.gov.uk and ico.org.uk before publishing your own compliance dates.
Will this run on shared hosting?
Yes. Complia requires PHP 8+ with pdo — present on virtually all cPanel/Plesk hosts. Installation takes about two minutes through the web installer.
Can multiple organisations share one install?
No — Complia is single-tenant, one organisation and one admin login per installation. DPOs running logs for multiple clients use one install per client.
Does it send emails automatically?
No — there's no built-in email sending. You acknowledge complainants from your own mailbox, and Complia records the timestamps.