Harper James advises UK businesses on handling data protection complaints under the laws of England and Wales. A consistent process helps an organisation identify the issue, meet applicable UK GDPR duties and maintain a clear record of its response.
Log the complaint when it arrives, including the complainant’s identity, date, issue raised, systems involved and requested outcome. Confirm receipt and identify whether the matter is a general concern, a data subject rights request, a direct marketing objection, or a suspected personal data breach. A request for access, rectification, erasure or restriction must be handled under the relevant UK GDPR rules rather than treated only as general correspondence.
Check the facts promptly. Identify what personal data is involved, the organisation’s role as controller or processor, the relevant privacy notice and the staff or supplier responsible for the processing. Restricting access to relevant records, preserving audit logs and involving the Data Protection Officer are appropriate where the complaint concerns security, sensitive data or a high-risk processing activity.
Give a clear response in plain English. Explain what was investigated, the information relied on, any corrective action and the complainant’s further options. For a data subject rights request, the usual response period is one month from receipt. The period extends by up to two further months for a complex request, but the organisation must tell the requester about the extension within the first month and explain the reason.
If the organisation refuses a request, the response should state the legal basis for refusal, explain the internal review process and tell the individual about their right to complain to the Information Commissioner’s Office (ICO) and seek a judicial remedy. The organisation should not disclose another person’s information when responding to a complaint or access request.
A complaint that indicates unauthorised access, loss, disclosure or alteration of personal data requires a separate breach assessment. Record the decision and reasoning, assess the risk to individuals and determine whether notification to the ICO is required within 72 hours of becoming aware of a reportable breach. Informing affected individuals is required where the breach presents a high risk to their rights and freedoms.
After closing the complaint, identify the underlying control failure. Actions include updating a privacy notice, correcting retention rules, improving staff training, changing supplier instructions or revising a data protection impact assessment. A management report should track the complaint, outcome, remedial action, owner and completion date. This evidence supports accountability and shows whether similar complaints are recurring.