Do I need to complain to the data controller before contacting the ICO?

You should first ask the data controller to fix the issue. The Information Commissioner's Office usually requires evidence that you gave the controller a chance to respond before they will investigate. You must allow a reasonable time, typically one month, plus a possible two-month extension, before filing a formal complaint.

Can the ICO award me compensation for distress?

No, the Information Commissioner's Office does not award compensation for distress. If you wish to claim damages for distress caused by a data protection breach, you must bring a separate claim in the County Court under section 168 of the Data Protection Act 2018. You can mention distress in your ICO complaint, but it will not result in a financial award from the regulator.

What information must I include in my formal complaint to the ICO?

Your complaint letter should include your personal details, the data controller's name and address, a description of the alleged breach, the specific UK GDPR or Data Protection Act 2018 provisions breached, and a summary of your correspondence with the controller. You must attach copies of all relevant correspondence to demonstrate you gave the controller a chance to respond.

What are common mistakes to avoid when submitting an ICO complaint?

The ICO will usually require evidence that you gave the data controller a reasonable opportunity to respond to your initial complaint. Filing a complaint before allowing this time, or failing to attach all correspondence with the controller, are common mistakes that may delay or hinder the investigation process.

Will the ICO share my complaint with the data controller?

Yes, you must consent to the Information Commissioner's Office sharing your complaint with the data controller. The template letter includes a statement confirming your consent to this sharing. This allows the controller to respond to the allegations made in your formal complaint.

When should I consider making a formal complaint to the ICO?

You can lodge a formal complaint with the Information Commissioner's Office if a data controller fails to comply with UK GDPR requirements, such as ignoring a subject access request, refusing erasure, or engaging in unlawful processing, and their response was inadequate or absent after you gave them a reasonable time to respond.

← All Templates

Data Protection

Data Protection & Privacy

Updated 2026-05-21

Formal Complaint to the ICO

Letter accompanying an ICO complaint about a data controller's failure to comply with UK GDPR.

This template was not drafted by a solicitor.

It is an editorial reference based on the official sources we cite. You are responsible for any document you send. For high-stakes matters (court proceedings, large sums, deportation, criminal allegations, child welfare), have a regulated solicitor review or draft your document.

When to use this template

You have asked a data controller to fix a UK GDPR issue (DSAR ignored, erasure refused, unlawful processing) and they have not, or their response was inadequate.

When NOT to use this template

Before you have given the controller a chance to respond — the ICO will usually require evidence of that first.

Legal Basis

UK GDPR Article 77; Data Protection Act 2018 s.165.

Before you send

Complaining before allowing the controller a reasonable time (1 month + possible 2-month extension)
Failing to attach all correspondence
Asking for compensation — the ICO does not award compensation. Distress damages go to the County Court under s.168 DPA 2018

Common Mistakes to Avoid

✗Complaining before allowing the controller a reasonable time (1 month + possible 2-month extension)
✗Failing to attach all correspondence
✗Asking for compensation — the ICO does not award compensation. Distress damages go to the County Court under s.168 DPA 2018

Build Your Letter

Fill in your details

Complete the fields below. Required fields are marked with *.

Date*

Data controller name*

Data controller address*

Your name*

Your date of birth*

Your reference with controller (if any)*

What the breach is*

Articles / sections breached*

Date you complained to the controller*

Summary of correspondence*

What you want the ICO to do*

Distress caused (optional)*

Letter preview

[Your Name]
[Your Address]
[Telephone] [Email]

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF

Date: [DATE]

Dear Sir or Madam,

Complaint about [DATA CONTROLLER NAME] — UK GDPR / Data Protection Act 2018

I wish to complain about the conduct of [DATA CONTROLLER NAME] ("the Controller") in relation to my personal data.

1. My details

Name: [YOUR NAME]
Address: [as above]
Date of birth: [YOUR DATE OF BIRTH]

2. The Controller

Name: [DATA CONTROLLER NAME]
Address: [DATA CONTROLLER ADDRESS]
My reference with them (if any): [YOUR REFERENCE WITH CONTROLLER (IF ANY)]

3. The breach alleged

[WHAT THE BREACH IS]

4. Specific UK GDPR / DPA 2018 provisions

[ARTICLES / SECTIONS BREACHED]

5. Correspondence with the Controller

I raised the issue with the Controller on [DATE YOU COMPLAINED TO THE CONTROLLER]. Their response (or absence of response) is summarised below and copies are enclosed:

[SUMMARY OF CORRESPONDENCE]

6. What I want from the ICO

[WHAT YOU WANT THE ICO TO DO]

7. Distress

[DISTRESS CAUSED (OPTIONAL)]

I understand that the ICO will share this complaint with the Controller and I consent to that. I also understand that the ICO does not award compensation for distress — separately, I may bring a claim in the County Court under section 168 of the Data Protection Act 2018.

Yours faithfully,

[YOUR NAME]

Unfilled fields appear as [FIELD NAME]. Review the letter carefully before sending. This template is a starting point — adapt it to your specific circumstances.

Official Resources

ICO complaints →

Frequently asked questions

Do I need to complain to the data controller before contacting the ICO?: You should first ask the data controller to fix the issue. The Information Commissioner's Office usually requires evidence that you gave the controller a chance to respond before they will investigate. You must allow a reasonable time, typically one month, plus a possible two-month extension, before filing a formal complaint.
Can the ICO award me compensation for distress?: No, the Information Commissioner's Office does not award compensation for distress. If you wish to claim damages for distress caused by a data protection breach, you must bring a separate claim in the County Court under section 168 of the Data Protection Act 2018. You can mention distress in your ICO complaint, but it will not result in a financial award from the regulator.
What information must I include in my formal complaint to the ICO?: Your complaint letter should include your personal details, the data controller's name and address, a description of the alleged breach, the specific UK GDPR or Data Protection Act 2018 provisions breached, and a summary of your correspondence with the controller. You must attach copies of all relevant correspondence to demonstrate you gave the controller a chance to respond.
What are common mistakes to avoid when submitting an ICO complaint?: The ICO will usually require evidence that you gave the data controller a reasonable opportunity to respond to your initial complaint. Filing a complaint before allowing this time, or failing to attach all correspondence with the controller, are common mistakes that may delay or hinder the investigation process.
Will the ICO share my complaint with the data controller?: Yes, you must consent to the Information Commissioner's Office sharing your complaint with the data controller. The template letter includes a statement confirming your consent to this sharing. This allows the controller to respond to the allegations made in your formal complaint.
When should I consider making a formal complaint to the ICO?: You can lodge a formal complaint with the Information Commissioner's Office if a data controller fails to comply with UK GDPR requirements, such as ignoring a subject access request, refusing erasure, or engaging in unlawful processing, and their response was inadequate or absent after you gave them a reasonable time to respond.