How to manage data protection complaints

A data protection complaint is a concern raised when someone believes you have not handled their personal information correctly under data protection law.

Common examples of data protection complaints

People can make a complaint directly to you if they think you have:

• responded incorrectly to a subject access request (SAR)
• responded incorrectly to other information rights requests
• collected, used, stored or shared their personal information improperly or unfairly
• kept their information for too long
• held inaccurate personal information about them
• failed to protect their personal information with appropriate security measures

People do not need to use legal language or refer to specific laws when making a complaint.

What doesn't count as a data protection complaint

Not every complaint involving personal information is a data protection complaint. For example:

• an employee may raise a workplace grievance, and also request copies of their personal information
• a customer may complain about service quality, and also ask you to delete their information

In these situations, the complaint itself may not be about data protection, even though the person is exercising their information rights. If you are unsure whether someone is making a data protection complaint, ask them to clarify.

You should identify and record data protection complaints as early as possible so you can handle them appropriately under the Data (Use and Access) Act 2025.