Make a complaint about how an organisation has used your personal information

Experiencing an issue related to your personal information may be difficult and sometimes distressing. Use this quick and easy service to find out what to do next if you've experienced an issue with an organisation about how they've handled your personal information. 

This page explains our complaint process, including: 

• Our approach to handling complaints
• What you need before you start
• What the outcome of your complaint could be
• If the ICO can award compensation

You'll then be able to make an online complaint. 

Our approach to handling complaints

We’ve changed how we handle complaints following a recent consultation. Our new approach focuses on cases where it’s clear that there’s serious harm and where we can help organisations improve how they protect people’s data through advice, training, or action. 

When you send us a complaint we’ll look at the details provided carefully. Our complaint form asks you for the information we need including any harm you’ve experienced because of the data protection issue you’re complaining about. 

You can be harmed when an organisation doesn’t follow data protection law while using your personal information. We use our judgement and assess harm on a scale from low to high-level impact to help us prioritise complaints. 

We use our data protection complaints handling framework to decide how much investigation is needed. This can range from a light-touch review to carrying out more detailed enquiries. The framework helps us be consistent while allowing us to be flexible enough for the wide range of complaints we receive. 

Complaints which we need to look at in more detail are currently being assigned to case officers within 40 weeks of submission. 

Before you start 

You’ll need: 

• an email address for the organisation; 
• a copy of the complaint you made to the organisation about how they have handled your personal information;
• a copy of your request (eg subject access request) if you made one to the organisation;
• any supporting information about the harm that was experienced because of the organisation’s handling of your personal information; and 
• (if you are complaining for someone else) a letter of consent from the person the complaint is about. 

It's helpful if you can also provide:

• the organisation's address;
• a timeline of key events related to your complaint;
• any supporting information you have about the mishandling of your personal information eg a copy of an email where your information was shared, a copy of records with inaccurate information, an apology letter from the organisation, or other email exchanges. 

Don't worry if you don't have this information call us on 0303 123 1113 or live chat with us so we can help you.

What will the outcome of my complaint be?

There are a number of possible outcomes to your complaint, the most common are:

• We will log the complaint but may only keep a record of it at this stage. Information like this can help us learn more about the way an organisation handles personal information and information rights. 
• We may tell the organisation to do more work to help resolve your complaint or explain their position more clearly. This could mean getting the organisation to provide you with your information or correct any inaccuracies. 

Can the ICO award compensation? 

No. The ICO can't award compensation, even when we give our opinion that an organisation has broken data protection law. 

You have a right to claim compensation from an organisation if you have suffered damage as a result of it breaking data protection law. This includes both material damage, for example if you have lost money, or non-material damage, for example if you have suffered distress. 

You don’t have to make a court claim to obtain compensation – the organisation may simply agree to pay it to you. However, if they don’t agree to pay, your next step would be to make a claim in court. The court would decide your case. If it agreed with you, it would decide whether or not the organisation would have to pay you compensation. 

We strongly recommend you take independent legal advice on the strength of your case before taking any claim to court.