The next stage of complaint is actually the local Information Commissioner.

Companies will usually comply with this, because it's very difficult to instruct staff to not comply with the law without leaving any records or risking one of them leaking it. However they will check what the legal minimum is and do that.