Formal Complaint to the ICO
Letter accompanying an ICO complaint about a data controller's failure to comply with UK GDPR.
This template was not drafted by a solicitor.
It is an editorial reference based on the official sources we cite. You are responsible for any document you send. For high-stakes matters (court proceedings, large sums, deportation, criminal allegations, child welfare), have a regulated solicitor review or draft your document.
When to use this template
You have asked a data controller to fix a UK GDPR issue (DSAR ignored, erasure refused, unlawful processing) and they have not, or their response was inadequate.
When NOT to use this template
Before you have given the controller a chance to respond — the ICO will usually require evidence of that first.
Legal Basis
UK GDPR Article 77; Data Protection Act 2018 s.165.
Before you send
- Complaining before allowing the controller a reasonable time (1 month + possible 2-month extension)
- Failing to attach all correspondence
- Asking for compensation — the ICO does not award compensation. Distress damages go to the County Court under s.168 DPA 2018
Common Mistakes to Avoid
- ✗Complaining before allowing the controller a reasonable time (1 month + possible 2-month extension)
- ✗Failing to attach all correspondence
- ✗Asking for compensation — the ICO does not award compensation. Distress damages go to the County Court under s.168 DPA 2018
Build Your Letter
Fill in your details
Complete the fields below. Required fields are marked with *.
Letter preview
[Your Name]
[Your Address]
[Telephone] [Email]
Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Date: [DATE]
Dear Sir or Madam,
Complaint about [DATA CONTROLLER NAME] — UK GDPR / Data Protection Act 2018
I wish to complain about the conduct of [DATA CONTROLLER NAME] ("the Controller") in relation to my personal data.
1. My details
Name: [YOUR NAME]
Address: [as above]
Date of birth: [YOUR DATE OF BIRTH]
2. The Controller
Name: [DATA CONTROLLER NAME]
Address: [DATA CONTROLLER ADDRESS]
My reference with them (if any): [YOUR REFERENCE WITH CONTROLLER (IF ANY)]
3. The breach alleged
[WHAT THE BREACH IS]
4. Specific UK GDPR / DPA 2018 provisions
[ARTICLES / SECTIONS BREACHED]
5. Correspondence with the Controller
I raised the issue with the Controller on [DATE YOU COMPLAINED TO THE CONTROLLER]. Their response (or absence of response) is summarised below and copies are enclosed:
[SUMMARY OF CORRESPONDENCE]
6. What I want from the ICO
[WHAT YOU WANT THE ICO TO DO]
7. Distress
[DISTRESS CAUSED (OPTIONAL)]
I understand that the ICO will share this complaint with the Controller and I consent to that. I also understand that the ICO does not award compensation for distress — separately, I may bring a claim in the County Court under section 168 of the Data Protection Act 2018.
Yours faithfully,
[YOUR NAME]Unfilled fields appear as [FIELD NAME]. Review the letter carefully before sending. This template is a starting point — adapt it to your specific circumstances.