Make a complaint about how an organisation has used your personal information
Seek clarity from the organisation
Before bringing your complaint to us, we recommend giving the organisation a chance to put things right. Many data protection concerns can be resolved quickly and easily by doing this.
To help you do this, we’ve provided a simple template below that you can use. We suggest sending your complaint as soon as possible to give the organisation the opportunity to respond.
If you’re unable to contact the organisation or do not wish to do so for example, if they haven’t responded to previous attempts or you feel it would not be safe or appropriate to do so you can still raise your concern with us here.
[Your full address]
[Your phone number]
[The date]
[Name and address of the organisation]
[Reference number (if provided within the initial response)]
Dear [Sir or Madam / name of the person you have been in contact with]
Information rights complaint.
[Your full name and address and any other details to help identify you, for example an account number.]
I am writing further to your recent letter/email about my information rights complaint because I would like further clarification.
Organisations have an obligation to clearly explain why they are using data in the way they do or why they have refused a request. This is set out under the accountability principle of the UK GDPR.
Accountability is one of the key principles in data protection law – it makes organisations responsible for complying with the legislation and says that they must be able to demonstrate their compliance.
I would like further clarification about
[Give details of what you don’t understand. You should refer specifically to the response you have already received where appropriate]
I understand that before reporting my complaint to the Information Commissioner I should give you the chance to provide a full explanation.
If, when I receive your response, I would still like to report my complaint, I will give them a copy of your response to consider.
You can find guidance on your obligations under information rights legislation on the ICO’s website (www.ico.org.uk) as well as information on their regulatory powers and the action they can take.
Please send a full response within one calendar month. If you cannot respond within that timescale, please tell me when you will be able to respond.
If there is anything you would like to discuss, please contact me on the following number [telephone number].
Yours faithfully/sincerely
[Signature]