Do I need to contact the organisation before complaining to the ICO?

You should only complain to the ICO after you have already raised the issue with the organisation concerned. The ICO expects you to have done this first. You can proceed if you received an unsatisfactory response or if the organisation did not respond within one calendar month. If you complain to the ICO before contacting the organisation, they will usually refer you back to them.

Will the ICO give me money if my complaint is successful?

No, the ICO does not award compensation. If you are seeking financial redress for a data protection breach, you may need to bring a court claim instead. The ICO’s role is to investigate the complaint and issue enforcement action, such as notices or fines, but it does not provide financial compensation to individuals.

What powers does the ICO have to deal with my complaint?

The ICO is the supervisory authority for data protection in the UK. It has the power to investigate complaints and issue enforcement notices and fines under the Data Protection Act 2018. You can make a formal complaint under Article 77 of the UK GDPR and Section 165 of the Data Protection Act 2018.

What documents should I include with my ICO complaint letter?

You should enclose a copy of your original complaint to the organisation and any response you received. It is important to keep copies of this correspondence. You may also include additional documents, such as screenshots or email chains, that support your complaint and help demonstrate the chronology of events.

How long does it take for the ICO to process a complaint?

Investigations by the ICO can take many months, so you should not expect your complaint to be handled quickly. It is a common misconception that an ICO ruling automatically results in compensation; it does not. You may still need to pursue court proceedings for financial redress.

← All Templates

Data Protection

Data Protection Law

Updated 2026-04-17

ICO Complaint Letter

Formal complaint to the Information Commissioner's Office about a data protection breach.

This template was not drafted by a solicitor.

It is an editorial reference based on the official sources we cite. You are responsible for any document you send. For high-stakes matters (court proceedings, large sums, deportation, criminal allegations, child welfare), have a regulated solicitor review or draft your document.

When to use this template

Use this after you have already complained to the organisation and either received an unsatisfactory response or received no response within one calendar month. The ICO is the supervisory authority for data protection in the UK and can investigate and issue enforcement action.

When NOT to use this template

Do not complain to the ICO before first raising the issue with the organisation concerned — the ICO expects you to have done so. The ICO does not award compensation; if you want financial redress, you may need to bring a court claim instead.

Legal Basis

UK GDPR Article 77 (right to lodge a complaint with a supervisory authority); Data Protection Act 2018 s.165. The ICO has powers to investigate and issue enforcement notices and fines under the DPA 2018.

Before you send

Complaining to the ICO before contacting the organisation — the ICO will usually refer you back
Not keeping copies of your original complaint and any response received
Expecting the ICO to handle your complaint quickly — investigations can take many months

Common Mistakes to Avoid

✗Complaining to the ICO before contacting the organisation — the ICO will usually refer you back
✗Not keeping copies of your original complaint and any response received
✗Expecting the ICO to handle your complaint quickly — investigations can take many months
✗Thinking an ICO ruling automatically gives you compensation — it does not; you may still need court proceedings

Build Your Letter

Fill in your details

Complete the fields below. Required fields are marked with *.

Your full name*

Your address*

Your email address*

Date of this letter*

Organisation you are complaining about*

Organisation address*

Summary of your complaint*

Chronology of events (dates and key facts)*

Date of your complaint to the organisation*

The organisation's response (or note that none was received)*

Specific UK GDPR/DPA 2018 provisions breached*

Optional fields

List of any additional documents enclosed

Letter preview

[YOUR FULL NAME]
[YOUR ADDRESS]
[YOUR EMAIL ADDRESS]

[DATE OF THIS LETTER]

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

---

Dear Sir or Madam,

**COMPLAINT ABOUT A DATA PROTECTION BREACH — [ORGANISATION YOU ARE COMPLAINING ABOUT]**

I write to make a formal complaint under Article 77 of the UK General Data Protection Regulation (UK GDPR) and Section 165 of the Data Protection Act 2018.

**Details of the Data Controller**

Organisation name: [ORGANISATION YOU ARE COMPLAINING ABOUT]
Organisation address: [ORGANISATION ADDRESS]

**Summary of my complaint**

[SUMMARY OF YOUR COMPLAINT]

**Chronology of events**

[CHRONOLOGY OF EVENTS (DATES AND KEY FACTS)]

**My complaint to the organisation**

I wrote to [ORGANISATION YOU ARE COMPLAINING ABOUT] on [DATE OF YOUR COMPLAINT TO THE ORGANISATION], setting out my concerns and requesting that they address the breach/request. I attach / enclose a copy of that correspondence.

**The organisation's response (or failure to respond)**

[THE ORGANISATION'S RESPONSE (OR NOTE THAT NONE WAS RECEIVED)]

**The data protection issue**

I believe the following provisions of the UK GDPR have been breached:

[SPECIFIC UK GDPR/DPA 2018 PROVISIONS BREACHED]

**What I am asking the ICO to do**

I request that the ICO:

1. Investigate my complaint and make a determination as to whether [ORGANISATION YOU ARE COMPLAINING ABOUT] has breached the UK GDPR or DPA 2018.
2. Take such enforcement action as the ICO considers appropriate.
3. Notify me of the outcome of any investigation.

**Documents enclosed**

- Copy of my original complaint to [ORGANISATION YOU ARE COMPLAINING ABOUT] dated [DATE OF YOUR COMPLAINT TO THE ORGANISATION]
- Copy of the response received (if any)
- [LIST OF ANY ADDITIONAL DOCUMENTS ENCLOSED]

Yours faithfully,

[YOUR FULL NAME]

Unfilled fields appear as [FIELD NAME]. Review the letter carefully before sending. This template is a starting point — adapt it to your specific circumstances.

Related Guides

Making A Dsar

Related Rights

Official Resources

ICO — Make a Complaint →

Frequently asked questions

Do I need to contact the organisation before complaining to the ICO?: You should only complain to the ICO after you have already raised the issue with the organisation concerned. The ICO expects you to have done this first. You can proceed if you received an unsatisfactory response or if the organisation did not respond within one calendar month. If you complain to the ICO before contacting the organisation, they will usually refer you back to them.
Will the ICO give me money if my complaint is successful?: No, the ICO does not award compensation. If you are seeking financial redress for a data protection breach, you may need to bring a court claim instead. The ICO’s role is to investigate the complaint and issue enforcement action, such as notices or fines, but it does not provide financial compensation to individuals.
What powers does the ICO have to deal with my complaint?: The ICO is the supervisory authority for data protection in the UK. It has the power to investigate complaints and issue enforcement notices and fines under the Data Protection Act 2018. You can make a formal complaint under Article 77 of the UK GDPR and Section 165 of the Data Protection Act 2018.
What documents should I include with my ICO complaint letter?: You should enclose a copy of your original complaint to the organisation and any response you received. It is important to keep copies of this correspondence. You may also include additional documents, such as screenshots or email chains, that support your complaint and help demonstrate the chronology of events.
How long does it take for the ICO to process a complaint?: Investigations by the ICO can take many months, so you should not expect your complaint to be handled quickly. It is a common misconception that an ICO ruling automatically results in compensation; it does not. You may still need to pursue court proceedings for financial redress.