Complia

Since 19 June 2026, UK data controllers acknowledge a data-protection complaint within 30 days (DPA 2018 s.164A). Complia, a self-hosted complaints register, records each complaint, its clock and its outcome.

The problem it solves

If someone complains about how you handled their personal data, you have to be able to show three things later: when the complaint arrived, what it said, and what you did about it. Many small organizations keep complaints in an inbox and a spreadsheet, with no timer and no audit trail. The UK now puts a clock on it: section 103 of the Data (Use and Access) Act 2025 adds a complaints duty for UK data controllers, including acknowledgment within 30 days; check its current text and commencement at legislation.gov.uk. Complia records each complaint against that clock, and the window is a setting. Complia ships configured for that clock, but the window is a setting - the register, intake form and audit export suit any regime that expects a complaints record.

Most small organizations currently handle this in an inbox and a spreadsheet, with no timer, no audit trail, and nothing to show the regulator.

Every feature

• A receipt to the complainant. Reference, dates, the response deadline and their tracking link — and deliberately not one word they wrote, because a register must never become the leak it exists to record. Doubly opt-in: you switch it on AND they tick the box. Sent once, ever.
• Evidence from the complainant. The public form can accept up to 3 files (PDF, PNG, JPEG, TXT, EML — decided by the file's bytes, not its name). Off by default; a refused file never loses the complaint, and the complainant is told what was kept.
• A tracking link that opens the case. The emailed link lands the complainant on their own case status — no re-typing a 40-character code. Bad tokens 404; the code alone stays the only credential.
• Public complaint form. A no-login public form you link from your privacy notice; complainants get a private tracking code on submission.
• Public status page. Complainants check progress with their tracking code — status only, no personal data exposed.
• 29-day acknowledgment timer. The admin register shows days-remaining and OVERDUE flags against the statutory acknowledgment window.
• Status workflow with audit log. Move complaints through received, acknowledged, investigating, resolved, or rejected, with an append-only, timestamped investigation log per complaint.
• Compliance dashboard. See open complaints, acknowledgments due within 7 days, overdue acknowledgments, and resolutions this month.
• Audit CSV export. Export the full register, including status history, as CSV to share with your DPO or a regulator.
• Installable mobile app (PWA). Add it to a phone or tablet home screen straight from the browser — a full-screen app served from your own server, with no app store involved. Business data is not stored offline on the device; what you see is read live.
• A report for the board. For any period: complaints received, acknowledged on time, late or not yet, the median days to acknowledge and to close, the outcomes, month by month, and who holds the open ones. Download it as CSV.
• Your procedure beside your register. Every version of your complaints procedure with the date it takes effect and its next review date; link the current one from your public complaint form.
• The records beside a complaint. Link a complaint to the subject access request it is about, or a breach record. If you run Privara, Complia reads that request's status and deadline for you.
• Updates from inside the app. The Updates page installs a new release with your license key: Ownware's signature is checked, a backup is taken first, and the app puts the previous version back by itself if the update is interrupted or the database step or start-up check of the new version fails. It never checks by itself.
• Backups by themselves. Automatic backups, an optional copy to S3-compatible storage you own, and a weekly check that the latest backup reads back. The Health page names anything that needs attention.
• Own It 4.0.1 — fixes and an up-to-date manual. For Complia, 4.0.1 fixes an installer that had lost its styling and a command-line update that ended in an error after putting the previous version back. Its manual, FAQ and QUICKSTART now cover everything 4.0 added, including two Nginx rules that keep the data folder private. Your license covers it: press Check for updates on the Updates page, or download it from your order page.
• Own It 4.0.2 — the installer opens on every host. For Complia, 4.0.2 fixes a fresh install on an Apache host: the one-page setup at /install/ looped back to itself and never opened, and now it opens. Complia's Docker image also gives the web server the whole app folder, so a Docker install can finish and update itself. Your license covers it: press Check for updates on the Updates page, or download it from your order page.

Release notes in full

• Own It 4.1: client installations and your other tools. For Complia, 4.1 makes two changes that every app gets. An Extended license bought from October 4, 2026 covers up to ten client installations, one per client project: hand each one over to the client or host it for them, with the client's logo and colors from the app's branding settings. The API reference now shows how to connect Complia to Zapier, Make or n8n, using its own webhooks and API key. Your license covers the update: press Check for updates on the Updates page, or download it from your order page.
• Own It 4.0: it updates and backs itself up. For Complia, 4.0 means updates from inside the app: the Updates page checks for a new release with your license key, verifies Ownware's signature, takes a backup and puts the previous version back by itself if the update is interrupted or the database step or start-up check of the new version fails. A new install can start with a sample business and remove it in one click; backups run by themselves, with an optional offsite copy and a weekly check that the latest one reads back; and the Health page says whether the install is looking after itself.
• Own It 3.3: the import preview tells the truth. The CSV import's preview used to count a complaint dated a day that does not exist as ready, and the import then skipped it. Now the preview shows it as skipped before you confirm, and the import itself refuses such a date.
• Own It 3.2: the register, reported upward. For Complia, the 3.2 wave brought a leadership report for the board, your complaints procedure kept beside the register with every version and its review date, and a complaint linked to the subject access request or breach record it concerns. Each new complaint and each acknowledgment reminder can also post one line to your team's chat: the number and the date, never what the complainant wrote.
• Own It 3.1: it writes to the people you serve. The 3.1 wave gave the catalog a way to reach the other side of the transaction: counterparty email through your own SMTP server, calendar feeds your own calendar subscribes to, attachments filed where the paperwork belongs, and export presets other people's software imports. Each outbound feature ships switched off and runs on your own credentials; a failed send is recorded, and the action that triggered it stands. What this app gained is listed at the top of this section.
• Own It 3.0: works for your AI, not just for you. Your statutory deadlines land in your calendar: a read-only feed of every open acknowledgment deadline, overdue ones saying so in the title, complaints you have marked as acknowledged dropping out automatically. The statutory-clock page computes overdue and due-soon the moment you look — deliberately a page, not a nightly email that can silently stop.
• Own It 2.0: API, 2FA, backups, dark mode. Complia 2.0 adds the 2.0 owner layer. Upgrade by replacing the files — the database migrates itself, and it is still the same one-time purchase.