Section 103 inserts new sections 164A and 164B into the DPA 2018.
	New section 164A outlines the procedures for dealing with complaints made by data subjects to data controllers.
	New section 164A(1) outlines the right of a data subject to complain to the data controller if the data subject considers that there is an infringement of their rights under the UK GDPR or Part 3 of the DPA 2018.
	New section 164A(2) requires controllers to facilitate the making of complaints under this section by taking appropriate steps. This could include providing a complaint form to be completed electronically, or other appropriate means.
	New section 164A(3) requires data controllers to acknowledge receipt of the complaint within a period of 30 days, beginning when the complaint is received.
	New section 164A(4) requires data controllers to take appropriate steps, without undue delay, to respond to the complaint and inform the complainant of the outcome of the complaint.
	New section 164A(5) explains that the requirement in subsection(4)(a) for data controllers to "take appropriate steps to respond to the complaint" includes making enquiries about the subject matter of the complaint to the extent appropriate, and informing the complainant about the progress of the complaint.
	New section 164B(1) sets out a power for the Secretary of State to make regulations to require controllers to notify the Commissioner of the number of complaints they have received in relation to the periods set out in regulations.
	New sections 164B(2)-(5) set out further detail in relation to the regulations. Any such regulations must be made in accordance with the negative resolution procedure.
	Subsections (3) to (6) of section 103 streamline provisions relating to complaints by data subjects, by merging relevant articles of the UK GDPR into the DPA 2018. This ensures relevant provisions regarding complaints to the Commissioner about infringements of the data protection legislation are located in section 165 of the DPA 2018.
	Subsection (7) introduces Schedule 10 containing miscellaneous minor and consequential amendments to the UK GDPR and the DPA 2018 relating to complaints by data subjects.
Part 5: Data Protection and Privacy Enforcement Section 103: Complaints by data subjects