The ICO exists to empower you through information.

Read our guidance

Before you make a complaint, read our guidance about making a SAR to check if the organisation has followed the law.

Sometimes you might be unhappy with the outcome of your request, but the organisation has done everything they have to do. 

Complain to the organisation

You can resolve many problems directly with the organisation.

If it has been over one month since you made your request and you’ve not heard from the organisation, you should send them a follow up email or letter.

If you’ve already received a response to your SAR, but are unhappy for any reason, you should first complain to the organisation. We recommend that you do this by email, where possible.

If you think personal information is missing from the response, you should clearly list what other information you think they also have. This will help them review their records.

Remember to keep copies of any letters or emails about your complaint, or written records about any calls or meetings you’ve had, as evidence.

You could use the following complaint letter or email template as a guide, adding in the details of your own complaint:

[Your full address]

[Phone number]

[The date]

[Name and address of the organisation]
[Reference number (if provided within the initial response)]

 

Dear [Sir or Madam / name of the person you have been in contact with]

Information rights complaint

[Your full name and address and any other details such as account number to help identify you]

I am concerned that you have not handled my personal information properly.

[Give details of your complaint, explaining clearly and simply what has happened and, where appropriate, its effect on you.]

I understand that before reporting my complaint to the Information Commissioner’s Office (ICO) I should give you the chance to deal with it.

If, when I receive your response, I would still like to report my complaint to the ICO, I will give them a copy of it to consider.

You can find guidance on your obligations under information rights legislation on the ICO’s website (www.ico.org.uk) as well as information on their regulatory powers and the action they can take.

Please send a full response within one calendar month. If you cannot respond within that time, please tell me when you will be able to respond.

If there is anything you would like to discuss, please contact me on the following number [telephone number].

Yours sincerely

[Signature]

Complain to the ICO

Once you have followed the steps above, you can make a complaint to us

You should raise your complaints with us within three months of your last meaningful contact with the organisation.

Remember to send us copies of all the key documents you have kept as evidence to support your complaint.

We cannot:

  • act as your representative; or
  • award compensation.

The ICO can punish an organisation for breaking the law, but we only use this power in the most serious cases. If we think the organisation has not responded to your request as they should’ve done, we can give them advice and ask them to solve the problem.

You can also seek to enforce your rights through the courts. If you decide to do this, we strongly advise you to seek independent legal advice first. We cannot help you with this process.