Data Protection Complaint Journey
The process for exercising data subject rights, making a complaint to the Information Commissioner's Office (ICO), and pursuing compensation through the courts if your data protection rights are breached.
Who Uses This Journey
Individuals who believe an organisation has mishandled their personal data in breach of the UK GDPR or Data Protection Act 2018 — whether by failing to respond to a Subject Access Request, sharing data without consent, retaining data too long, or causing harm through a data breach.
Stage-by-Stage Timeline
Submit a Subject Access Request (SAR)
A Subject Access Request (SAR) is a right under UK GDPR Article 15 to request a copy of all personal data held about you by an organisation. Submit in writing (email is fine) to the data controller's data protection officer (DPO). The request is free. Include proof of identity if requested.
- Written SAR (email or letter) clearly requesting all personal data
- Proof of identity if requested
- Specify any particular categories of data or time periods if needed
- Sending SAR to the wrong department — address to the DPO or data protection team
- Not keeping a copy of your SAR and the date it was sent
- Expecting more than a copy of your data — a SAR is not a right to explain decisions, only to see data
Await Response (1 Month)
The organisation must respond within 1 calendar month of receiving the SAR. They may: provide all the data; provide partial data (with explanations for anything withheld); request clarification of identity; or wrongly refuse. Note the exact date of your SAR to track the deadline.
- Full response received — review for accuracy and completeness
- Partial response — organisation claims exemptions
- Extension notified — further 2 months allowed
- No response or refusal — complain to ICO
- Accepting an incomplete response without questioning exemptions claimed
- Not checking the data provided is actually accurate
Raise Concerns with the Organisation
Before complaining to the ICO, you should usually try to resolve the issue directly with the organisation. Write formally, identifying exactly what you believe is wrong (incomplete SAR, unlawful processing, inaccurate data, failure to erase under Article 17, etc.) and what you want done.
- Going straight to the ICO without trying to resolve directly — the ICO expects this step
- Not specifying which UK GDPR rights have been breached
Complain to the ICO
If not resolved, submit a complaint to the Information Commissioner's Office online. The ICO will investigate whether the organisation has complied with data protection law. The ICO can issue: enforcement notices, warnings, reprimands, and fines (up to £17.5 million or 4% global turnover).
- ICO upholds complaint — organisation directed to comply
- ICO issues enforcement notice
- ICO closes complaint — no further action
- ICO refers matter to formal investigation
- Expecting the ICO to pursue compensation on your behalf — it cannot do this; you need a court claim
- Not providing all relevant documents to the ICO at the outset
ICO Investigation
The ICO investigates the complaint. Both parties may be asked to provide information and documents. The ICO may use its powers to audit the organisation. Investigations can take 3–12 months. The ICO is not obliged to take formal enforcement action in every case.
- ICO upholds complaint and issues reprimand or enforcement notice
- ICO closes complaint without formal action (considers it resolved)
- ICO fines the organisation
- ICO advises the complainant to pursue civil claim for compensation
- Waiting for ICO resolution before starting the 6-year limitation clock for a court claim
- Not documenting the distress, financial loss, or damage caused by the breach
Court Claim for Compensation
A data subject has the right to claim compensation from an organisation for material or non-material damage under UK GDPR Article 82 and DPA 2018 s.168. 'Non-material damage' includes distress. Court claims can be brought in the County Court. Issue Form N1, set out the breach, and quantify damages (financial loss + distress).
- Evidence of the breach (communications, SAR response, breach notification letter)
- ICO decision or correspondence
- Evidence of financial loss (e.g. fraud, identity theft costs)
- Medical evidence if claiming for psychiatric injury
- Diary evidence of distress
- Not quantifying the damage — courts need specific figures
- Claiming distress without any supporting evidence
Official Sources
Know Your Rights
Frequently asked questions
- How do I ask a company for my personal data?
- You should submit a Subject Access Request (SAR) in writing, such as by email, to the organisation’s data protection officer. The request is free and allows you to see all personal data held about you. You must keep a copy of your request and the date sent. Note that a SAR only gives you the right to see your data, not to receive explanations for decisions made by the organisation.
- How long does a company have to reply to my data request?
- The organisation must respond within one calendar month of receiving your request. They may extend this by two months for complex requests, but they must notify you within the first month. If they do not respond, provide incomplete data, or wrongly refuse, you can complain to the Information Commissioner’s Office (ICO). Always note the exact date you sent your request to track this deadline.
- Can the Information Commissioner’s Office give me money if my data is mishandled?
- The ICO can issue enforcement notices, warnings, reprimands, or fines of up to £17.5 million or 4% of global turnover. However, the ICO cannot award compensation on your behalf. If you suffer material or non-material damage, such as distress, you must pursue a separate civil claim in the County Court to recover compensation.
- How long do I have to sue a company for data protection damages?
- You generally have six years from the date of the breach to bring a court claim for compensation. You should not wait for the ICO to finish its investigation before starting this limitation clock. To succeed, you must quantify your damage, including financial loss and distress, and provide supporting evidence such as medical records or a diary of your distress.
- Do I have to complain to the company before going to the ICO?
- Before contacting the ICO, you should usually try to resolve the issue directly with the organisation. Write a formal letter identifying exactly what you believe is wrong and what you want done. The ICO expects this step to have been taken. If the organisation does not resolve the issue within a reasonable time, typically 30 days, you can then submit a complaint to the ICO online.
- Is there a deadline for complaining to the ICO?
- You should complain to the ICO within three months of the organisation’s final response. The ICO will investigate whether the organisation complied with data protection law. Investigations can take three to twelve months. The ICO is not obliged to take formal enforcement action in every case and may close the complaint if it considers the matter resolved.