Data Protection Complaints Procedure 

Our approach  

We are committed to processing personal data in line with our data protection obligations and based on the UK GDPR principles, i.e.: 

• processing personal data lawfully, fairly and in a transparent way; 

• collecting personal data for specific and legitimate purposes and not processing personal data in a way that is incompatible with those purposes; 

• collecting and using adequate, relevant and minimal personal data; 

• taking reasonable steps to make sure personal data is accurate and kept up to date; 

• not keeping personal data longer than necessary; and 

• implementing appropriate security measures to protect personal data. 

There may be times when we don’t get it right, and, if so, we want you to let us know. We take complaints very seriously and aim to learn from them to improve our standards of service and data protection controls. 

How to make a data protection complaint 

The table below shows the different ways you can contact us to make a complaint. 

What happens next? 

We will acknowledge your complaint within 30 days of receiving it. 

We may ask for information to check your identity and if someone is making a complaint on your behalf we will also need to check that the person making the complaint is allowed to do so. 

If we are unable to identify you / verify the authority of the person making the complaint, we may not be able deal with it.  

Considering and investigating your complaint 

We will consider your complaint without undue delay and keep you/your authorised representative updated at appropriate intervals on the progress of our investigation. 

The usual steps in the process are: 

1. reviewing your complaint; 

2. locating and reviewing relevant information we hold relating to the complaint;  

3. establishing the relevant facts;  

4. consulting staff involved in handling your personal data; 

5. considering compliance with our policies and procedures; and 

6. Taking steps to resolve the complaint and improve future compliance. 

We may need to ask you for further information or documents. If so, we will ask you to provide the information within a specific period of time so that we can respond to your complaint within a reasonable time frame. 

Notifying you of the outcome of our investigation 

We will let you/your authorised representative know the outcome of the complaint without undue delay. 

We will explain clearly what we’ve done to deal with your complaint and, where appropriate, any action we have taken as a result. 

If we can’t resolve your complaint 

We hope that we will be able to resolve your complaint to your satisfaction, but, if you are unhappy with the outcome, you can complain to the Information Commissioner’s Office (ICO) or you can take action in the courts. 

The ICO’s contact details are: 

More details on how to complain to the ICO are available on the Complaints page of the ICO’s website. You should usually submit your complaint to the ICO within three months of your last contact with us. 

Data protection rights and non-data protection related complaints 

Please note that if you are looking to exercise one of your rights under UK GDPR (right to access, information, rectification, restriction, erasure, object, portability, rights in relation to automated decision making) we have a separate procedure for this and we will handle your request in accordance with this procedure.  

You can find more information about your data protection rights and how to exercise them in our privacy notice, which can be found here. 

If your complaint does not relate to data protection, please see use our contact us using the contact us section of our website.