A data protection complaint is a concern raised when someone believes you have not handled their personal information correctly under data protection law.
Common examples of data protection complaints
People can make a complaint directly to you if they think you have
People do not need to use legal language or refer to specific laws when making a complaint.
What doesn’t count as a data protection complaint
Not every complaint involving personal information is a data protection complaint. For example
- an employee may raise a workplace grievance, and also request copies of their personal information
- a customer may complain about service quality, and also ask you to delete their information
In these situations, the complaint itself may not be about data protection, even though the person is exercising their information rights. If you are unsure whether someone is making a data protection complaint, ask them to clarify.
You should identify and record data protection complaints as early as possible so you can handle them appropriately under the Data (Use and Access) Act 2025.
