Online Safety Act Complaints Procedure Requirements

The Online Safety Act requires regulated services to run a complaints procedure that users can find and use. It is one of the duties that applies to in-scope user-to-user and search services, alongside the risk assessment duties.

This guide explains what the complaints duty requires, what kinds of complaint you must be able to handle, and how it differs from the data protection complaints regime.

The Complaints Duty

The duty sits in section 21 of the Online Safety Act 2023. It requires you to operate a complaints procedure that allows users and affected people to make relevant kinds of complaint, and that provides for appropriate action to be taken in response.

The procedure has to be easy to access, easy to use, including for children where relevant, and transparent. Users should not have to hunt for a way to raise a concern.

What Complaints You Must Handle

The Act sets out the kinds of complaint your procedure has to accept. These connect to the wider safety duties.

• Complaints that the service contains illegal content.
• Complaints that the service contains content that is harmful to children, where the child safety duties apply.
• Complaints from a user whose content has been taken down or restricted, where they think that was wrong.
• Complaints from a user whose account has been suspended or banned.
• Complaints that the provider is not complying with its duties under the Act.

What a Compliant Complaints Procedure Contains

A procedure that meets section 21 needs a clear route in and a defined way of dealing with what comes through it.

• An obvious and accessible way to complain, available to users and to people affected by the service.
• Clear categories so complaints can be routed and prioritised.
• A defined process for assessing a complaint and taking appropriate action.
• Timeframes for handling complaints and telling the complainant the outcome.
• A record of complaints received and how they were resolved.

Complaints and Record-Keeping

Complaints handling links to the record-keeping and review duty in section 23. Keeping a clear log of what was raised and how you responded supports both your complaints duty and your risk assessments.

Patterns in complaints are also evidence. If the same harm keeps being reported, that should feed back into your illegal content or children's risk assessment.

How This Differs From Data Protection Complaints

The Online Safety Act complaints duty is about content and safety on your service. It is separate from the data protection complaints duty that applies to how you handle personal data.

From 19 June 2026, controllers also have to handle data protection complaints under the Data Use and Access Act. If your service processes personal data, you need both, and our data protection complaints procedure guide covers that separate duty.

Complaints Duties at a Glance

Requirement	What it means
Legal basis	Section 21 of the Online Safety Act 2023
Accessible	Easy to find and use, including for children where relevant
Scope	Illegal content, content harmful to children, wrongful takedown, account action, breach of duties
Action	Assess the complaint and take appropriate action
Records	Log complaints and outcomes under section 23

How Policy Pros Can Help

We write Online Safety Act complaints procedures that meet section 21 and fit the way your service actually runs. The procedure sets out the complaint routes, the categories, the handling steps and the records to keep.

We keep it consistent with your illegal content risk assessment and your IT security policies, and we can pair it with your data protection complaints process so the two regimes do not contradict each other. For the wider picture, see our Online Safety Act small business guide.

The duty is set out in section 21 of the Act, with the official summary in the GOV.UK Online Safety Act explainer.