Harper James is a UK full-service commercial law firm whose practice includes data protection and Data Protection Officer support. A data protection complaint may concern the use, disclosure, retention or security of personal data, or the handling of a data subject right such as access, rectification, erasure or objection to direct marketing. Complaints can arise from customers, employees, suppliers or other individuals whose personal data an organisation processes.
Nominate a responsible person and record the complaint when it arrives. Acknowledge receipt, confirm the issues raised and check the complainant’s identity where the matter involves personal data. Review the relevant privacy notice, processing records, contracts, consent records, access logs and correspondence. Establish what happened, which legal basis and purpose applied, whether the data was accurate, and whether the organisation followed its own procedures.
Give a clear written response that addresses each issue. Explain the relevant facts, the decision reached and any action taken, such as correcting data, stopping direct marketing, deleting information where required, or improving access controls. An ordinary data protection complaint has no universal statutory response deadline, but the organisation should set a reasonable timescale and explain any delay. A subject access request is different and is normally subject to a one-month response period under the UK GDPR, subject to the applicable rules on complexity and extensions.
If the complainant remains dissatisfied, explain their right to complain to the Information Commissioner’s Office (ICO). The ICO generally expects individuals to raise the issue with the organisation first. The organisation should retain the complaint, investigation notes, evidence, response and any remedial action. A pattern of similar complaints should be reported through appropriate governance channels and may justify a data protection impact assessment, policy review, staff training or changes to supplier arrangements. The ICO can investigate regulatory concerns and take enforcement action, but compensation claims are generally pursued separately through the courts or another appropriate process.