The ICO exists to empower you through information.

View our 'what we do with your personal data when you...' infographic for a basic overview of the below information.


Purpose and lawful basis for processing

Our purpose is to investigate and take regulatory action in line with our statutory duties.

The lawful basis we rely on to process your personal data is article 6(1)(e) of the UK GDPR, which allows us to process personal data when this is necessary to perform our public tasks as a regulator.

If the information you provide us in relation to your complaint contains special category data, such as health, religious or ethnic information the lawful basis we rely on to process it is article 9(2)(g) of the UK GDPR, which also relates to our public task and the safeguarding of your fundamental rights. And Schedule 1 part 2(6) of the DPA2018 which relates to statutory and government purposes.

What we need

We need information from you to investigate your complaint properly, so our complaint forms are designed to prompt you to give us everything we need to understand what’s happened.

When we receive a complaint from you, we’ll set up a case file. This normally includes your contact details and any other information you have given us about the other parties in your complaint.

Why we need it

We need to know the details of your complaint so we can investigate it and fulfil our regulatory function.

What we do with it

We will use your personal information to investigate your complaint, and may also check on our level of service by inviting you to complete a customer satisfaction survey. We compile and publish statistics showing information like the number of complaints we receive, but not in a form that identifies anyone. 

No third parties have access to your personal information unless the law allows them to do so. However, if you have made a complaint about an organisation, we usually have to disclose your identity to them. This is so we can clearly explain to them what you think has gone wrong and if necessary advise them how to put it right. This also means we may receive information about you from them.

If you don’t want information that identifies you to be shared with the organisation you want to complain about, we’ll try to respect that. However, it is not always possible to handle a complaint on an anonymous basis so we’ll contact you to discuss this.

If you contact us to make a freedom of information complaint about a public authority, and we issue a decision notice, we will need you to provide us with an identifiable correspondence address or personal email address which will be included on a copy of any decision notice provided to the public authority about which you have complained.

If you are acting on behalf of someone making a complaint, we’ll ask for information to satisfy us of your identity and if relevant, ask for information to show you have authority to act on someone else’s behalf.

When we send you the outcome of your complaint, we’ll include a link to an optional survey that you can complete to let us know what you think about the service you received. You’ll need to provide your case reference number and a ranking for each of the criteria in the survey. We’ll use your feedback to help us gauge how well we’re handling complaints and to identify opportunities for improvement.

We may also contact you to ask if you would be interested in participating in a customer satisfaction survey. If you would like to be included, we will pass your name and email address onto a third party to complete the survey on our behalf.

How long we keep it

For information about how long we hold personal data, see our retention schedule.

If you agree to participate in the customer experience survey, ICS will keep your survey response for 30 days from the survey closes. They will keep your name and email address for 9 months from the survey expiry date.

What are your rights?

We are acting in our official capacity to investigate your complaint, so you have the right to object to our processing of your personal data. There are legitimate reasons why we may refuse your objection, which depend on why we are processing it.

For more information on your rights, please see ‘Your rights as an individual’.

Do we use any data processors?

We do not use data processors to handle complaints.

We use Microsoft Forms for our complaint handling feedback survey.

We use the Institute of Customer Service (ICS) as a data processor to run our customer satisfaction surveys.