Make a complaint about how an organisation has used your personal information
-
1. What is your complaint about?
Accessing personal information from an organisation
-
2. Is the information you want to access about you or another living person?
Yes - it's about me or another living person
-
3. What are the details of your complaint?
My request was refused
-
4. Have you complained to the organisation directly?
Yes
-
5. How did the organisation respond when you complained?
They responded with an explanation but I don't understand it
Seek clarity from the organisation
In most cases, organisations should clearly explain why they have refused a request.
If the organisation responds in a way you don’t understand, you should ask for clarity.
You can use the template below to write or email to the organisation to help seek clarity about why they have refused some or all of your request. Organisations should respond to you within a month.
We expect you to seek a full and final response from an organisation before complaining to us. If you've not sought clarity before submitting a complaint, we may ask you to do so and this will delay the progress of your complaint.
[Your full address]
[Your phone number]
[The date]
[Name and address of the organisation]
[Reference number (if provided within the initial response)]
Dear [Sir or Madam / name of the person you have been in contact with]
Information rights complaint.
[Your full name and address and any other details to help identify you, for example an account number.]
I am writing further to your recent letter/email about my information rights complaint because I would like further clarification.
Organisations have an obligation to clearly explain why they are using data in the way they do or why they have refused a request. This is set out under the accountability principle of the UK GDPR.
Accountability is one of the key principles in data protection law – it makes organisations responsible for complying with the legislation and says that they must be able to demonstrate their compliance.
I would like further clarification about
[Give details of what you don’t understand. You should refer specifically to the response you have already received where appropriate]
I understand that before reporting my complaint to the Information Commissioner I should give you the chance to provide a full explanation.
If, when I receive your response, I would still like to report my complaint, I will give them a copy of your response to consider.
You can find guidance on your obligations under information rights legislation on the ICO’s website (www.ico.org.uk) as well as information on their regulatory powers and the action they can take.
Please send a full response within one calendar month. If you cannot respond within that timescale, please tell me when you will be able to respond.
If there is anything you would like to discuss, please contact me on the following number [telephone number].
Yours faithfully/sincerely
[Signature]