Make a complaint about how an organisation has used your personal information
Mae’r gwasanaeth yma yn cael ei adolygu ar hyn o bryd a bydd yn ddwyieithog cyn gynted â phosib. Ymddiheuriadau am unrhyw anghyfleusterau. This service is currently under review and will be available bilingually as soon as possible. We apologise for any inconvenience.
Experiencing an issue related to your personal information may be difficult and sometimes distressing. Use this quick and easy service to find out what to do next if you've experienced an issue with an organisation and how they've handled your personal information.
This service will help you decide if we're the right organisation to complain to about your experience. You'll then be able to make an online complaint.
Complaints are being assigned to case officers within 29 weeks of submission.
What you'll need
You'll need:
- an email address for the organisation;
- a copy of the complaint you made to the organisation about how they have handled your personal information; and
- (if you are complaining for someone else) a letter of consent from the person the complaint is about.
It's helpful if you can also provide:
- the organisation's address;
- a timeline of key events related to your complaint;
- any supporting information you have about the mishandling of your personal information eg a copy of an email where your information was shared, a copy of records with inaccurate information, an apology letter from the organisation, or other email exchanges.
Don't worry if you don't have this information call us on 0303 123 1113 or live chat with us so we can help you.
What will the outcome of my complaint be?
There are a number of possible outcomes to your complaint, the most common are:
- We tell the organisation to take action. We can tell the organisation to do more to help resolve your complaint, explain their decision to you more clearly or to make changes so similar issues don't happen to you or other people in the future.
- We don't take action. Despite the difficult experience you've had with the organisation, it might be that they have followed the law - this means we're unable to take any action. There might be times when we find the organisation was at fault but we're happy with how they handled your concerns after that and we chose not to take action.
Can the ICO award compensation?
No. The ICO can't award compensation, even when we give our opinion that an organisation has broken data protection law.
You have a right to claim compensation from an organisation if you have suffered damage as a result of it breaking data protection law. This includes both material damage, for example if you have lost money, or non-material damage, for example if you have suffered distress.
You do not have to make a court claim to obtain compensation – the organisation may simply agree to pay it to you. However, if they do not agree to pay, your next step would be to make a claim in court. The court would decide your case. If it agreed with you, it would decide whether or not the organisation would have to pay you compensation.
We strongly recommend you take independent legal advice on the strength of your case before taking any claim to court.