First things first. Acknowledge receipt of the complaint.

If you already have a complaints process, you could send a copy of it to the complainant.  This will tell the complainant what they can expect from the complaints process.  However, if you don’t have a suitable complaints process, tell the person:

• That you have received their complaint and you are looking into it
• What the timeline of your investigation and response looks like
• What you will do
• When they can expect a response
• Who to contact if they would like to speak to someone.

Investigate the data protection complaint

Deal with complaints promptly once they have been received.  After acknowledging, gather as much information as you think is necessary so that you can establish all the relevant facts.  You might need to refer back to the complainant for more information. Check the details of the complaint against the information that you hold and facts you have been able to establish.

Record the complaint and your actions

Keep a record of what information you hold, what facts have been established, who is involved in and what you are doing about it.  The more you understand about the complaint the better position you will be in to respond and resolve.

Your record should include the date that the complaint was received and the date when a response is due, which is usually 8 weeks after receipt.

Keep details of any related conversations and copies of all relevant documents from start to finish, including the reasons for the decisions you’ve made and any action taken, or not taken. This will help if the complainant is unhappy and takes their complaint further, for instance to the ICO.  

Update the complainant regularly

If you think that there is a lot to investigate and is likely to take a while to complete, provide the complainant with regular updates. It helps the complainant to feel “seen” and not ignored.  Use plain language and avoid jargon or legal terms.

Respond with your decision regarding the data protection complaint

Let the person know, in clear and specific language the outcome of the investigation.  Start by listing the areas of complaint and explain clearly what your decision is, why you have reached the decision that you have reached and provide appropriate evidence to support your decision.  You should also explain what actions you have taken as a result of the complaint, which might be additional training

Review your data protection processes

View the complaint as an opportunity to improve your data protection processes and prevent future complaints from happening in the future.

Key data protection complaint handling takeaways

• Keep records organised and up to date
• Have a complaints procedure
• Create templates to use in response
• Provide staff with training
• Regularly review feedback and complaints

Contact us to help you respond appropriately to data protection complaints

We can help you understand your data protection obligations, in more detail, so that you can comply with the law and put procedures in place to deal appropriately with any data protection complaints, and prevent them from escalating. We can also guide you in how your processes can be improved, to help avoid future issues.