Data Protection Complaints Procedure

1. Our approach  

1.1 We are committed to processing personal data in line with our data protection obligations and based on the UK GDPR principles, i.e.: 

1.1.1 processing personal data lawfully, fairly and in a transparent way;

1.1.2 collecting personal data for specific and legitimate purposes and not processing personal data in a way that is incompatible with those purposes; 

1.1.3 collecting and using adequate, relevant and minimal personal data;

1.1.4 taking reasonable steps to make sure personal data is accurate and kept up to date;

1.1.5 not keeping personal data longer than necessary; and

1.1.6 implementing appropriate security measures to protect personal data.

1.2 We are committed to handling your personal data responsibly and with care, and we understand that there may be times when we don’t get it right. If you are unhappy with how we have collected, used, shared, or otherwise handled your personal data, we would genuinely like you to tell us. We take data protection complaints very seriously, and we welcome the opportunity to investigate your concerns and to put things right, so far as we are able. We also aim to learn from every complaint so that we can improve our standard of service and strengthen our data protection controls.

2. How to make a data protection complaint 

The table below shows the different ways you can contact us to make a complaint. 

3. What happens next?  

3.1 We will acknowledge your complaint within 30 days of receiving it, although we will begin investigating your complaint as soon as we receive it, without waiting for the 30-day acknowledgement period to expire.

3.2 We may ask for information to check your identity and if someone is making a complaint on your behalf we will also need to check that the person making the complaint is allowed to do so.

3.3 If we are unable to identify you / verify the authority of the person making the complaint, we may not be able deal with it. 

3.4 Where a complaint is made by or on behalf of a child, we will use clear and plain language appropriate to the child’s age and understanding in all our communications. We will assess whether the child has sufficient competence to understand and exercise their rights, and will ensure that the complaint is handled with appropriate care.

4. Considering and investigating your complaint 

4.1 We will consider your complaint without undue delay and keep you/your authorised representative updated at appropriate intervals on the progress of our investigation. Where the investigation is likely to take some time, we will contact you to explain any delays and provide an estimated timeframe for when we expect to conclude our investigation. 

4.2 The usual steps in the process are: 

4.2.1 reviewing your complaint;

4.2.2 verifying identity and/or authority;

4.2.3 locating and reviewing relevant information we hold relating to the complaint; 

4.2.4 establishing the relevant facts; 

4.2.5 consulting staff involved in handling your personal data;

4.2.6 considering compliance with our policies and procedures; and

4.2.7 Taking steps to resolve the complaint and improve future compliance.

4.3 We may need to ask you for further information or documents. If so, we will ask you to provide the information within a specific period of time so that we can respond to your complaint within a reasonable time frame.

5. Notifying you of the outcome of our investigation 

5.1 We will let you/your authorised representative know the outcome of the complaint without undue delay. We aim to provide a full response within 8 weeks of receiving your complaint, although straightforward complaints may be resolved more quickly. Where a complaint is more complex and requires additional time, we will keep you informed of our progress and the reasons for any delay.

5.2 We will clearly explain the outcome of your complaint and, where appropriate, any action we have taken as a result. 

6. If we can’t resolve your complaint 

6.1 We hope that we will be able to resolve your complaint to your satisfaction, but, if you are unhappy with the outcome, you can complaint to the UK or EEA data protection regulator, in particular, the regulator for the Member State in which you reside or work, or in the member state where the activity which gave rise to the complaint occurred or our lead supervisory authority as applicable. In the United Kingdom, the data protection supervisory authority is the Information Commissioner’s Office (ICO).

6.2 The ICO’s contact details are:

6.3 More details on how to complain to the ICO are available on the Complaints page of the ICO’s website. Please note that you do not have to wait for us to complete our investigation before contacting the ICO — you can complain to the ICO at any point. However, the ICO’s own guidance suggests that complaints to the ICO are usually made within three months of your last substantive contact with us.

7. Data protection rights and non–data protection related complaints 

7.1 Please note that if you are looking to exercise one of your rights under UK GDPR (right to access, information, rectification, restriction, erasure, object, portability, rights in relation to automated decision making) we have a separate procedure for this and we will handle your request in accordance with this procedure. 

7.2 You can find more information about your data protection rights and how to exercise them in our privacy notice, which can be found here. Our privacy notice also confirms your right to make a data protection complaint directly to us (as required by the Data (Use and Access) Act 2025), as well as your right to complain to the ICO.

7.3 Should your complaint not relate to data protection, we would nevertheless ask that you contact us at [email protected]. We will then endeavour to redirect your complaint to the appropriate team, insofar as we are reasonably able to do so.