Data Protection Complaints Policy

Introduction

The Data Protection Act 2018 is the main law governing data protection. You have the right to complain directly to us if you consider that we have breached data protection laws because of the way we have handled your personal data, or the personal data of someone you are acting on behalf of.

This Policy explains your right to complain and how we will handle your complaint.

1. Roles and Responsibilities

  1. John Gallagher is responsible for handling data protection complaints within our organisation. They will work alongside other members of our organisation who have been identified as relevant to the investigation of each complaint.
  2. All staff are responsible for recognising data protection complaints.
  3. Staff who receive or identify a data protection complaint, whether in person, via social media or through any other channel, must inform John Gallagher as soon as possible.
  4. We are committed to handling data protection complaints in line with our legal obligations and in an accessible, fair, transparent and timely manner.

We will handle complaints confidentially and will only share information where appropriate to investigate and resolve the complaint, as required or authorised by law, or otherwise in accordance with our privacy notices.

2. Types of Complaint

Examples of a data protection complaint include, but are not limited to, complaints concerning:

  • The way we have responded to a subject access request (SAR) or another data rights request. Please see our separate Policy on Your Rights in Relation to Your Data for information about individual data rights.
  • The security measures we have used to store your information, for example where you have been affected by a data breach.
  • How we have collected or used your personal information, including where we have stored it, how long we have retained it or whether it is accurate.

This list is not exhaustive. You have the right to complain to us at any time if you consider that there has been an infringement of any of your rights in relation to your personal data.

Information about how we handle your personal data is set out in our separate privacy notices, available on our website at www.jdg.co.uk.

Complaints About Other Matters

Complaints about matters that do not relate to data protection, such as customer service issues, will not be treated as data protection complaints. For complaints that are not about data protection, please visit our website to view our complaints policy.

If we are unsure whether you are making a data protection complaint, we will contact you to clarify the nature of your complaint.

Employees who wish to raise a grievance should do so under our grievance procedure.

If your complaint relates to whistleblowing, please read our separate whistleblowing procedure.

3. How to Make a Data Protection Complaint

You can submit a complaint directly to us using any of the following methods:

This list is not exhaustive. We will take appropriate steps to respond to data protection complaints received through other channels, including social media.

Reasonable Adjustments

We will comply with our duty to make reasonable adjustments to our data protection complaints process for disabled people under the Equality Act 2010.

If you feel that you would benefit from any adjustments to our complaints process, please raise this with us when making your complaint.

4. Complaints Made on Social Media

Although data protection complaints may be made on social media, a complaint may be handled more efficiently and effectively if it is submitted using one of the contact methods set out above.

Where we identify a data protection complaint about our organisation on social media, we will take appropriate steps to respond in line with this Policy.

As social media is not usually a secure way of providing information, we will ask the individual making the complaint to provide an alternative contact method that we can use to respond.

5. Complaints from Children

We will respond to data protection complaints from children using plain and clear language that they can understand at every stage of the complaints process.

We will comply with our obligations to assess the competence of the child to understand and exercise their rights.

6. Responding to Your Complaint

  1. When we receive a data protection complaint, we will acknowledge receipt no later than 30 days after receiving it.
  2. If we have any doubts about your identity, we may ask you to provide proof of identification before we respond to your complaint.
  3. Complaints made on your behalf by a third party must be accompanied by evidence that the third party is authorised to act for you.
  4. If evidence of authority is not provided, we will contact the third party and request it before responding to the complaint.
  5. If we are unsure whether a letter of authority is valid, we will contact you before responding to the complaint.
  6. We will take appropriate steps to respond to your complaint without undue delay. This may include making enquiries, investigating the complaint and keeping you informed about the progress of our investigation.
  7. We will provide information about the expected timescale for the next update or outcome.
  8. We may contact you to request further information that will assist with our investigation.
  9. It may take longer to investigate and resolve complaints that are complex, serious or relate to multiple data protection issues.
  10. Following our investigation, we will inform you of the outcome without undue delay.

Our response will explain:

  • Our findings.
  • Whether the complaint has been upheld, either in whole or in part.
  • Any action that has been taken or is proposed.
  • Where no action is taken, the reasons for that decision.

7. Complaints About Data Processors

Where we receive a complaint relating to the processing of personal information by one of our service providers, we will ask the service provider to provide information relevant to the complaint without undue delay and in accordance with our contractual terms.

8. Training

We will provide training to all staff on how to recognise a data protection complaint and what to do if they receive one, including where the complaint should be directed within our organisation.

9. Record Keeping

We will keep a record of:

  • The date on which we receive the data protection complaint.
  • Our acknowledgement of the complaint.
  • Any relevant conversations and documents.
  • The outcome of the complaint.
  • Any action taken as a result of our investigation.

We may use these records:

  • To demonstrate compliance.
  • For audit and monitoring purposes.
  • For staff training.
  • To support the consistent handling of complaints.
  • To identify recurring issues, trends or areas requiring organisational improvement or remediation.

We will not retain personal data relating to complaints for longer than necessary.

Further information about our retention periods is set out in our privacy notices, available on our website at www.jdg.co.uk.

10. Complaints to the Information Commissioner’s Office

You have the right to make a data protection complaint at any time to the Information Commissioner’s Office (ICO).

ICO Contact Details

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline: 0303 123 1113

Website: www.ico.org.uk

Whatsapp