I’m worried about how an organisation has handled my information, what should I do?

We are here to help you

We are here to help you understand the next steps, and whether complaining to the ICO is right for you.

You can call us to talk through your options. Our number is 0303 123 1113, or you can start a live chat with one of our colleagues.

We advise you to contact the organisation first to ask for an explanation – this could resolve the issue and address your concerns. If you're not happy with the response, you may find that you want to make a complaint to us at the ICO.

Contacting the organisation

Here is some wording you can use to email or write to an organisation.

This should cover everything that you need to provide to the organisation, so they can respond to you.

We also have detailed guidance on writing a complaint.

Data protection complaint template complaint letter

[Name and address of the organisation]
[Reference number (if provided within the initial response)]

Dear [Sir or Madam / name of the person you have been in contact with]

Data Protection Complaint

[Your full name and address and any other details such as account number to help identify you]

I am concerned that you have not handled personal information properly.

[Give details of your complaint, explaining clearly and simply what has happened and, where appropriate, the effect it has had on you.]

I understand that before reporting my complaint to the Information Commissioner’s Office (ICO) I should give you the chance to deal with it.

If, when I receive your response, I would still like to report my complaint to the ICO, I will give them a copy of it to consider.

You can find guidance on your obligations under information rights legislation on the ICO’s website (www.ico.org.uk) as well as information on their regulatory powers and the action they can take.

Please send a full response within 30 days. If you cannot respond within that timescale, please tell me when you will be able to respond.

If there is anything you would like to discuss, please contact me on the following number [telephone number].

Yours faithfully

[Signature]

You can download our template to email or write to an organisation.

What will happen next?

The organisation should reply to you in one month. Try and keep a record of anything you send to them, so you know the date by which they should reply to you. If they don't reply within one month, please remember that information if you complain to the ICO.

If you’re not happy with the response, or don’t receive one, we can help you decide what to do next.

If the organisation gives you a response that is not clear, you are entitled to ask them for clarification. Here is some wording you can use.

Clarification template letter

[Your full address]
[Your phone number]
[The date]

[Name and address of the organisation]
[Reference number (if provided within the initial response)]

Dear [Sir or Madam / name of the person you have been in contact with]

Information rights complaint.

[Your full name and address and any other details to help identify you, for example an account number.]

I am writing further to your recent letter/email about my information rights complaint because I would like further clarification.

Organisations have an obligation to clearly explain why they are using data in the way they do or why they have refused a request. This is set out under the accountability principle of the DPA 2018.

Accountability is one of the key principles in data protection law – it makes organisations responsible for complying with the legislation and says that they must be able to demonstrate their compliance.

I would like further clarification about

[Give details of what you don’t understand. You should refer specifically to the response you have already received where appropriate]

I understand that before reporting my complaint to the Information Commissioner I should give you the chance to provide a full explanation.

If, when I receive your response, I would still like to report my complaint, I will give them a copy of your response to consider.

You can find guidance on your obligations under information rights legislation on the ICO’s website (www.ico.org.uk) as well as information on their regulatory powers and the action they can take.

Please send a full response within one calendar month. If you cannot respond within that timescale, please tell me when you will be able to respond.

If there is anything you would like to discuss, please contact me on the following number [telephone number].

Yours faithfully/sincerely
[Signature]

You can download the clarification template letter

Who can help me?

If you’re not happy with the response, or want more information on your options, you can contact the ICO. Our helpline number is 0303 123 1113 or you can start a live chat with us. We can provide advice on your next steps.

The ICO is here to make sure organisations look after your personal information carefully.

We can help you to decide if making a complaint to the ICO is right for you, and help explain what organisations can and can't do with your personal information.

If you do decide to complain to us, we will look into what has happened, and may make recommendations to the organisations so they improve their practices.

Making a complaint to the ICO can all be done online, in your own time.