What is a data protection complaint
Understand what counts as a data protection complaint - and what doesn't - under the Data (Use and Access) Act 2025.
A data protection complaint is a concern raised when someone believes you have not handled their personal information correctly under data protection law.
Common examples of data protection complaints
People can make a complaint directly to you if they think you have:
- responded incorrectly to a subject access request (SAR)
- responded incorrectly to other information rights requests
- collected, used, stored or shared their personal information improperly or unfairly
- kept their information for too long
- held inaccurate personal information about them
- failed to protect their personal information with appropriate security measures
People do not need to use legal language or refer to specific laws when making a complaint.
What doesn't count as a data protection complaint
Not every complaint involving personal information is a data protection complaint. For example:
- an employee may raise a workplace grievance, and also request copies of their personal information
- a customer may complain about service quality, and also ask you to delete their information
In these situations, the complaint itself may not be about data protection, even though the person is exercising their information rights. If you are unsure whether someone is making a data protection complaint, ask them to clarify.
You should identify and record data protection complaints as early as possible so you can handle them appropriately under the Data (Use and Access) Act 2025.