1. Purpose
To ensure that all data protection complaints are handled fairly, promptly, and in compliance with UK GDPR and Data Protection Act 2018.
2. Scope
This process applies to:
Customers
Employees
Suppliers
Any individual whose personal data is processed by the organisation
3. What is a Data Protection Complaint?
A complaint relating to how personal data is:
Collected
Stored
Used
Shared
Retained or deleted
Examples:
Unauthorised disclosure of personal data
Failure to respond to a Subject Access Request (SAR)
Incorrect personal data being held
Concerns about data security
4. How to Submit a Complaint
Complaints can be submitted via:
Email: robert.morrish@marketowndeveloments.com
Post: Newlands House, Pound Street, Petworth GU28 0DX
Complainants should provide:
- Full name and contact details
- Details of the complaint
- Relevant dates and evidence
- Desired outcome
5. Acknowledgement
All complaints must be acknowledged within 5 working days
- A reference number will be assigned
- The complainant will be informed of:
- Expected timelines
- Next steps
6. Investigation Process
6.1 Initial Assessment
Determine if the complaint relates to data protection
Assess urgency (e.g., potential data breach)
6.2 Assign Responsibility
Complaint assigned to:
Data Protection Officer (DPO), or
Relevant senior manager (if no DPO)
6.3 Investigation Actions
May include:
Reviewing systems, records, and policies
Interviewing staff
Checking audit logs
Assessing compliance with GDPR principles
7. Response Timeframes
Full response issued within 1 calendar month
If complex:
Can extend to up to 3 months
Complainant must be informed within the first month
8. Outcome and Response
The final response must include:
- Findings of the investigation
- Whether the complaint is upheld or not
- Actions taken (if applicable), such as:
- Data correction or deletion
- Process improvements
- Staff training
- Explanation of decision
9. Escalation
If the complainant is dissatisfied:
- They may request an internal review
- Review conducted by a senior, independent person (if possible)
10. Right to Complain to ICO
Inform the complainant of their right to escalate:
- Information Commissioner’s Office (ICO)
- Website: https://www.ico.org.uk
- Typically expected within 3 months of last contact
11. Record Keeping
Maintain a log of:
- Complaint details
- Investigation steps
- Correspondence
- Final outcome
Retention period: minimum 3 years
12. Continuous Improvement
- Analyse complaint trends
- Implement corrective actions
- Update policies and training as needed
13. Roles and Responsibilities
DPO – Oversight, investigation, compliance advice
Management – Ensure corrective actions implemented
Staff – Report issues and cooperate with investigations
14. Confidentiality
All complaints must be handled confidentially and only shared on a need-to-know basis.
15. Review of Process
This process should be reviewed annually or following:
- Legislative changes
16. Data Protection Complaint Form
Please complete this form if you wish to make a complaint about how your personal data has been collected, used, stored, shared, retained, or deleted. Completed forms should be sent to robert.morrish@marketowndeveloments.com or posted to Newlands House, Pound Street, Petworth GU28 0DX.
Download Data Protection Complaint Form