- Step 1 – Complain to the organisation
- Step 2 – Report your concerns to the ICO
- Further advice from the ICO
You can resolve many problems directly with the organisation.
If you have already received a response, but are unhappy for any reason, you should first make a complaint to the organisation.
We recommend that you do this in writing.
If you think personal information is missing from their response, you should clearly list what other information you think they also hold. This will help them review their records.
Remember to keep copies of any correspondence about your complaint, as evidence.
You could use the following complaint letter template as a guide, adding in the details of your own complaint:
[Your full address]
[Name and address of the organisation]
[Reference number (if provided within the initial response)]
Dear [Sir or Madam / name of the person you have been in contact with]
Information rights concern
[Your full name and address and any other details such as account number to help identify you]
I am concerned that you have not handled my personal information properly.
[Give details of your concern, explaining clearly and simply what has happened and, where appropriate, its effect on you.]
I understand that before reporting my concern to the Information Commissioner’s Office (ICO) I should give you the chance to deal with it.
If, when I receive your response, I would still like to report my concern to the ICO, I will give them a copy of it to consider.
You can find guidance on your obligations under information rights legislation on the ICO’s website (www.ico.org.uk) as well as information on their regulatory powers and the action they can take.
Please send a full response within one calendar month. If you cannot respond within that time, please tell me when you will be able to respond.
If there is anything you would like to discuss, please contact me on the following number [telephone number].
If you’ve complained to an organisation and you still do not receive any response, or remain unhappy with their handling of your subject access request, you can make a complaint to the ICO.
- act as your representative;
- award compensation; or
- punish an organisation for breaking the law (apart from in the most serious cases).
However, if we think the organisation has not responded to your request as it should have done, we can give them advice and ask them to solve the problem.
You should raise your concerns with us within three months of your last meaningful contact with the organisation.
Remember to send us copies of all the key documents you have to support your complaint, which you kept as evidence.
You can also seek to enforce your rights through the courts. If you decide to do this, we strongly advise you to seek independent legal advice first.
We can help you understand how to best work with the organisation to resolve your concern.
For further advice, you can contact us via our live chat service or call our helpline on 0303 123 1113.