The UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

On this page you can get the answers to the following questions about submitting complaints to the ICO:

What do I need to do before I can complain to the ICO?

You can complain to the ICO about the way an organisation has handled your personal information.

In most cases, before you complain to us you need to have:

  • complained directly to the organisation;
  • followed up with the organisation if you have not received a response after 30 days; and
  • asked for clarification from the organisation if you have had a response you don’t understand.

If you have followed all these steps or have not received a response from the organisation you can submit your complaint. You should do this within three months of contacting  the organisation.

What can the ICO do to help me?

  • We can consider complaints about the way your information has been handled and whether there has been an infringement of the data protection law. We will share a decision about what we think should happen next. Sometimes this can help to resolve the detail of your complaint but this may not always be the case.
  • We can make recommendations to organisations to put things right or to improve their practices when we think it is necessary to do so.
  • We will usually ask the organisation to do everything they can to explain how they have handled or processed your personal data as the law expects.
  • Where we have significant concerns about an organisations ability to comply with the law, we can take regulatory action.

What can't the ICO do?

  • We cannot award compensation like a court or a tribunal.
  • We cannot consider complaints that do not involve the processing of personal information. The information has to relate to living individuals.
  • We cannot deal with cases of fraud. Action Fraud has advice about this on their website.
  • We cannot stop individuals using CCTV on their own property. You can find more information about domestic CCTV in our guidance.
  • We cannot usually deal with cases where there’s been an undue delay of three months or more in bringing it to our attention. If there’s a reason for the delay you may want to contact us for advice about what to do.
  • We cannot deal with complaints about customer service eg if you’ve been locked out of an online account or are unhappy with the service you’ve received.
  • We cannot make an organisation apologise to you if things have gone wrong.

What happens when I submit my complaint to the ICO?

When you bring your complaint to us and we’ve checked it’s something we can help with – a case officer will be given your complaint to look into.

The case officer will:

  • weigh up the facts of what’s happened, fairly and impartially;
  • ask the organisation and you for further information if they think they need it; and
  • tell you and the organisation the outcome of our considerations.

If we think there’s been an infringement of the law, we will usually provide advice so the organisation can take steps to put things right and improve their information rights practices. We deal with most complaints in this way without the need to take further regulatory action.

How long will it take to deal with my complaint?

At the moment we are allocating cases within three months of receipt and they are usually allocated in date order.

We aim to deal with complaints as soon as we can. Some complaints can be dealt with quickly but some may require more work and take longer.

What are the possible outcomes of my complaint?

Data protection law requires us to investigate a complaint to the extent we feel is appropriate and to inform you of the outcome. Most organisations want to do the right thing and comply with the law.  

There are a number of potential outcomes for a complaint:

  1. We can find the organisation has acted properly and there is no further work for us. 
  2. We can record your complaint without taking further action to help us build a picture of how an organisation is complying with the law.
  3. We can tell the organisation to do more work to help resolve your complaint or explain their position more clearly to you. This could mean getting the organisation to provide you with your information or correct any inaccuracies.
  4. We can make recommendations to the organisation about how they can improve their information rights practices. This can include asking an organisation to review their policies or procedures, guidance or standards.
  5. We can take regulatory action, but this is only in the most serious cases. We do not normally take regulatory action for individual complaints as we want organisations to comply with the law without us using our formal powers. It is therefore unlikely we will take regulatory action as a result of your complaint. However, even if we don’t take action, we will keep a record of the complaint to help us to build up a picture of how well an organisation is following the law.

Can the ICO award compensation?

No. The ICO cannot award compensation, even when we give our opinion that an organisation has broken data protection law.

You have a right to claim compensation from an organisation if you have suffered damage as a result of it breaking data protection law. This includes both material damage, for example if you have lost money or non-material damage, for example if you have suffered distress.

You do not have to make a court claim to obtain compensation – the organisation may simply agree to pay it to you. However, if they do not agree to pay, your next step would be to make a claim in court. The court would decide your case. If it agreed with you, it would decide whether or not the organisation would have to pay you compensation.

We strongly recommend you take independent legal advice on the strength of your case before taking any claim to court.

If the organisation you are complaining about is a member of an ombudsman scheme and your complaint relates to the service you received, the ombudsman may be able to help you.  This could include securing financial compensation or receiving an apology. To find out if the organisation you are complaining about is a member of an ombudsman scheme on the Ombudsman Association website.

 

What can I do if I am unhappy with the outcome of my complaint?

If you disagree with the outcome of your complaint you can ask us for a case review.  A reviewing officer will look at how the complaint has been handled and will write to you with their findings within 30 calendar days.