ICO Complaint Letter
Formal complaint to the Information Commissioner's Office about a data protection breach.
When to use this template
Use this after you have already complained to the organisation and either received an unsatisfactory response or received no response within one calendar month. The ICO is the supervisory authority for data protection in the UK and can investigate and issue enforcement action.
When NOT to use this template
Do not complain to the ICO before first raising the issue with the organisation concerned — the ICO expects you to have done so. The ICO does not award compensation; if you want financial redress, you may need to bring a court claim instead.
Legal Basis
UK GDPR Article 77 (right to lodge a complaint with a supervisory authority); Data Protection Act 2018 s.165. The ICO has powers to investigate and issue enforcement notices and fines under the DPA 2018.
Common Mistakes to Avoid
- ✗Complaining to the ICO before contacting the organisation — the ICO will usually refer you back
- ✗Not keeping copies of your original complaint and any response received
- ✗Expecting the ICO to handle your complaint quickly — investigations can take many months
- ✗Thinking an ICO ruling automatically gives you compensation — it does not; you may still need court proceedings
Build Your Letter
Fill in your details
Complete the fields below. Required fields are marked with *.
Optional fields
Letter preview
[YOUR FULL NAME] [YOUR ADDRESS] [YOUR EMAIL ADDRESS] [DATE OF THIS LETTER] Information Commissioner's Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF --- Dear Sir or Madam, **COMPLAINT ABOUT A DATA PROTECTION BREACH — [ORGANISATION YOU ARE COMPLAINING ABOUT]** I write to make a formal complaint under Article 77 of the UK General Data Protection Regulation (UK GDPR) and Section 165 of the Data Protection Act 2018. **Details of the Data Controller** Organisation name: [ORGANISATION YOU ARE COMPLAINING ABOUT] Organisation address: [ORGANISATION ADDRESS] **Summary of my complaint** [SUMMARY OF YOUR COMPLAINT] **Chronology of events** [CHRONOLOGY OF EVENTS (DATES AND KEY FACTS)] **My complaint to the organisation** I wrote to [ORGANISATION YOU ARE COMPLAINING ABOUT] on [DATE OF YOUR COMPLAINT TO THE ORGANISATION], setting out my concerns and requesting that they address the breach/request. I attach / enclose a copy of that correspondence. **The organisation's response (or failure to respond)** [THE ORGANISATION'S RESPONSE (OR NOTE THAT NONE WAS RECEIVED)] **The data protection issue** I believe the following provisions of the UK GDPR have been breached: [SPECIFIC UK GDPR/DPA 2018 PROVISIONS BREACHED] **What I am asking the ICO to do** I request that the ICO: 1. Investigate my complaint and make a determination as to whether [ORGANISATION YOU ARE COMPLAINING ABOUT] has breached the UK GDPR or DPA 2018. 2. Take such enforcement action as the ICO considers appropriate. 3. Notify me of the outcome of any investigation. **Documents enclosed** - Copy of my original complaint to [ORGANISATION YOU ARE COMPLAINING ABOUT] dated [DATE OF YOUR COMPLAINT TO THE ORGANISATION] - Copy of the response received (if any) - [LIST OF ANY ADDITIONAL DOCUMENTS ENCLOSED] Yours faithfully, [YOUR FULL NAME]
Unfilled fields appear as [FIELD NAME]. Review the letter carefully before sending. This template is a starting point — adapt it to your specific circumstances.