Do I need to complain to the company before contacting the ICO?

You must first complain to the data controller in writing, stating the breach and your desired outcome. The controller has one month to respond, which can be extended by two months for complex cases. You should only submit a complaint to the ICO if the controller has not resolved the issue, generally within three months of their final response.

What evidence should I include when submitting an ICO complaint?

You should provide copies of your correspondence with the controller, including your original data subject access request or rights request and their response (or lack thereof). Include evidence of the alleged breach, such as screenshots of unlawful processing or marketing communications received, and clearly state what you want the controller to do.

What are the possible outcomes of an ICO investigation?

The ICO may decide to take no further action, issue a reprimand letter, issue an enforcement notice, or issue a monetary penalty notice. In rare cases, they may refer the matter to prosecution. Monetary penalties can be up to £17.5m or 4% of global turnover, though these are rare for individual complaints.

How long does the ICO complaint process usually take?

The typical timeframe from complaint to an ICO decision is between three and nine months. The process involves the ICO assessing the complaint, potentially asking both parties for further information, and then issuing a decision. Less serious complaints may receive a 'no further action' decision with general guidance.

All Legal Journeys

Data Protection & Privacy

UK-wide

5 stages

3–9 months from complaint to ICO decision

Reviewed 2026-05-21

ICO Complaint Journey

From data protection breach to ICO investigation outcome and any onward appeal to the First-tier Tribunal.

This page covers UK-wide law. Where local procedure differs (e.g. courts or tribunals), this is noted in the relevant section.

Who Uses This Journey

Data subjects whose UK GDPR rights have been breached (e.g. DSAR refused, data inaccurately processed, marketing without consent) and whose initial complaint to the controller has not been resolved.

Stage-by-Stage Timeline

Complain to the controller first

The ICO requires (in most cases) that you give the controller a chance to respond. Send a written complaint stating the breach and what you want the controller to do.

Deadline: Controller has 1 month to respond (extendable by 2 months for complex cases)

Submit ICO complaint

Online form at ico.org.uk/make-a-complaint. Provide copies of correspondence, the alleged breach, and what you want.

Deadline: Generally within 3 months of the controller's final response

Evidence Needed

Original DSAR or rights request
Controller's response (or lack of it)
Screenshots of unlawful processing
Marketing communications received

ICO assessment

Caseworker reviews. May ask both sides for further information. Less serious complaints may receive a 'no further action' decision with general guidance.

ICO outcome

Possible outcomes: no further action; reprimand; enforcement notice; monetary penalty notice (up to £17.5m or 4% of global turnover); referral to prosecution.

Possible Outcomes

No further action
Reprimand letter
Enforcement notice
Monetary penalty (rare for individuals)

Appeal (if applicable)

An enforcement notice or penalty notice can be appealed to the First-tier Tribunal (General Regulatory Chamber, Information Rights). Data subjects can also separately claim damages for distress in the County Court under s.168 DPA 2018.

Deadline: 28 days from notice

Possible Outcomes

Tribunal upholds, varies, or quashes the notice

Official Sources

ICO complaints First-tier Tribunal (Information Rights)Data Protection Act 2018 s.168

Frequently asked questions

Do I need to complain to the company before contacting the ICO?: You must first complain to the data controller in writing, stating the breach and your desired outcome. The controller has one month to respond, which can be extended by two months for complex cases. You should only submit a complaint to the ICO if the controller has not resolved the issue, generally within three months of their final response.
What evidence should I include when submitting an ICO complaint?: You should provide copies of your correspondence with the controller, including your original data subject access request or rights request and their response (or lack thereof). Include evidence of the alleged breach, such as screenshots of unlawful processing or marketing communications received, and clearly state what you want the controller to do.
What are the possible outcomes of an ICO investigation?: The ICO may decide to take no further action, issue a reprimand letter, issue an enforcement notice, or issue a monetary penalty notice. In rare cases, they may refer the matter to prosecution. Monetary penalties can be up to £17.5m or 4% of global turnover, though these are rare for individual complaints.
How long does the ICO complaint process usually take?: The typical timeframe from complaint to an ICO decision is between three and nine months. The process involves the ICO assessing the complaint, potentially asking both parties for further information, and then issuing a decision. Less serious complaints may receive a 'no further action' decision with general guidance.