If an organisation has mishandled your personal information, this guide explains how to make a GDPR complaint in the UK, use a subject access request (SAR), keep track of deadlines and evidence, escalate to the Information Commissioner’s Office (ICO), and assess whether another remedy may be available.
Overview
UK data protection complaints usually begin with the organisation that controls or processes your information. This might be a retailer, employer, landlord, bank, insurer, public body, website or app. The organisation may have breached your rights by using inaccurate information, failing to answer a data request, retaining data without a clear reason, sending unwanted marketing, losing personal data or sharing it inappropriately.
The UK data protection framework includes the UK GDPR and the Data Protection Act 2018. Your rights depend on the circumstances and are not all absolute. For example, an organisation may have a lawful reason to retain some information even after you ask for deletion, or it may be able to refuse part of a request where an exemption applies.
A strong GDPR complaint is specific rather than simply stating that your privacy has been violated. Identify what happened, which information is involved, what you asked the organisation to do, when you contacted it and what outcome you want. Keep the complaint separate from wider service or refund disputes where possible, so the data protection issue is easy to investigate.
For help preparing a wider complaint, see the UK complaint letter template toolkit. It can help you organise facts, evidence and requested remedies before you contact the organisation.
What to track
Create a simple privacy complaint log. A spreadsheet, notes app or dated folder is enough. Track the following information:
- The organisation: record its legal or trading name, contact details, privacy notice and any data protection contact address.
- The personal data involved: note whether the issue concerns contact details, financial information, health information, identity documents, employment records, account activity, communications, location data or another category.
- The event: describe what happened in plain language. Include the date or date range, how you discovered it and anyone who may have received the information.
- Your legal request: record whether you asked for access, correction, erasure, restriction of processing, an objection, data portability or an explanation of automated decision-making.
- Communications: save your original message, acknowledgement, replies, telephone notes and attachments. After a call, send a short email confirming what was discussed.
- Deadlines: record when each request was received, when a response is due and when any extension or clarification request was notified.
- Impact: document distress, financial loss, identity theft risk, practical inconvenience or decisions affected by inaccurate data. Keep supporting evidence, but avoid collecting or sharing unnecessary sensitive information.
A subject access request asks an organisation to confirm whether it processes your personal data and, subject to applicable limits and exemptions, provide a copy and related information. It is not a general demand for every document an organisation holds, and it does not automatically require disclosure of another person’s information. You can make a SAR in writing, including by email, and should describe the account, transaction or period that will help the organisation locate the data.
A useful subject access request template might say: “Please treat this as a subject access request under the applicable UK data protection law. Please confirm whether you process my personal data and provide a copy of my personal data, together with the relevant information about its use. My identifying details are [details], and the request relates to [account, service or dates].” Send only the identification information reasonably needed to verify you.
Cadence and checkpoints
Manage the complaint as a sequence of checkpoints rather than sending repeated messages without a record.
- Day one: preserve evidence. Download relevant account records, save emails and screenshots, and write a short chronology. Do not alter original files where their original form may matter.
- Initial contact: send the request or complaint to the organisation’s privacy team or data protection contact. State the facts, the right or concern involved, the remedy requested and a reasonable method for replying.
- Response window: monitor the date the organisation received the request. A SAR will generally require a response within one month, although the period and any permitted extension can depend on the request’s complexity, volume and the circumstances. Check current ICO guidance for the applicable rule.
- Clarification checkpoint: if the organisation asks for clarification, respond promptly but do not volunteer irrelevant information. Ask what part of the request it cannot locate or understand.
- Final internal complaint: if the response is incomplete, inaccurate or unexplained, write once more. List each unresolved point and attach the earlier correspondence rather than restarting the entire history.
- Escalation review: if the organisation does not resolve the issue, consider complaining to the ICO. Keep your evidence bundle concise: chronology, request, response, follow-up and the specific outcome you seek.
The ICO can investigate concerns about data protection compliance and may contact the organisation. It is not generally a compensation service and may not determine every private dispute or secure payment for you. If you suffered damage or distress, consider taking independent legal advice about a possible compensation claim. The court route, evidence requirements and time limits can be different from an ICO complaint, so avoid assuming that one automatically preserves the other.
How to interpret changes
Not every refusal means that an organisation has ignored your rights. Examine the explanation and ask whether it answers the particular request. A complete response should normally identify what was done, what information was found or withheld, and why any limitation, redaction or refusal applies.
Common warning signs include an organisation treating a SAR as a general customer-service complaint, failing to address a correction request, giving an unexplained blanket refusal, continuing to use demonstrably inaccurate information, or sending you between departments without identifying who is handling the data issue.
Separate a data accuracy problem from a disagreement about an opinion. You may be able to challenge a wrong address, date, payment status or factual record. An organisation may not have to replace a professional assessment simply because you disagree with its conclusion, although you can ask for your disagreement to be recorded where appropriate.
For deletion and objection requests, ask what processing will stop, what data must be retained and the legal or operational reason given for retaining it. For marketing concerns, keep copies of messages, consent records and opt-out confirmations. For an apparent breach, focus on what data was exposed, when you were told, what practical risk followed and what steps the organisation took to contain it.
When to revisit
Revisit your privacy complaint at each meaningful change: when a request is acknowledged, when a deadline passes, when a new response arrives, when inaccurate data is corrected or when the organisation changes its explanation. A monthly check is useful for an open complaint with continuing consequences; a quarterly review can be enough for a dormant issue, recurring marketing problem or long-running account dispute.
Update your records if your contact details, account status, evidence or understanding of the event changes. Check the ICO’s current information before escalating, because complaint routes, guidance and available online forms may change. Also review whether the organisation has published a final response or internal appeal route.
Take action now by creating a dated chronology, sending a focused complaint or SAR, and setting a calendar reminder for the expected response date. If the response is late or inadequate, send a short final follow-up that lists the unresolved points. Then decide whether an ICO complaint, another regulator, a contractual remedy or independent legal advice is the most suitable next step. For broader limitation guidance, consult the UK legal time limits and limitation periods checklist, while remembering that it is general information rather than a calculation of your individual claim.
