People can complain to the Information Commissioner’s Office (ICO) if they are unhappy with how you have handled their personal information.
The ICO usually expect people to raise their data protection concerns with you first and give you an opportunity to resolve the issue.
When the ICO receives a complaint, they first assess if it is something they can help with. They can only deal with data protection complaints. If the complaint includes other issues (for example customer service or employment matters), you may need to refer the person to another service.
When the ICO assesses a complaint, they may consider
- the nature of the issue
- any harm or impact resulting from the issue
- the steps an organisation has taken to address the concern
- whether they received similar complaints or information on the issue
Read the full ICO criteria for triaging data protection complaints.
Depending on the circumstances, they may
- record the complaint for information
- ask you to review the issue and consider relevant guidance
- contact you for further information
- investigate the matter further
Not every complaint will result in an investigation or regulatory action. Where appropriate, the ICO may provide advice, guidance or recommendations instead to help you improve your data protection practices.