Data-protection complaint

Complaint or rights request?

They are related, but they are not the same thing.

A rights request asks the organisation to do something with your personal data. A data-protection complaint says you believe the organisation has mishandled your information or a rights request. Since June 2026 organisations have specific duties for handling data-protection complaints, including acknowledging them within 30 days and investigating them appropriately.

Say what happened without trying to write a legal pleading.
Separate each data-protection concern into a numbered issue.
Identify the affected data and the relevant dates.
Ask for the practical correction and a reasoned complaint outcome.

Editable template

Version 1: complaint about a failed data-rights request

Use this after a SAR, rectification, erasure, restriction or other rights request has been mishandled.

How to edit it: replace everything in square brackets with your own details. If a bracketed paragraph does not apply, delete it before sending.

Subject: Data-protection complaint: handling of my [SAR / rectification / erasure / restriction / other] request: [reference]

Dear Data Protection Team,

Please treat this as a data-protection complaint about your handling of my [type of request] dated [date].

Issue 1: [for example: overdue response / missing data / refusal without adequate reasons]
What happened: [brief facts and dates]
Evidence: [request, response, email, screenshot or other record]
What I say remains wrong: [specific point]

Issue 2: [second issue, if any]
What happened: [facts]
Evidence: [evidence]
What I say remains wrong: [specific point]

Outcome requested
Please:
• [complete/correct/reconsider the rights request];
• [correct any related record or process]; and
• provide a written complaint outcome addressing each numbered issue and explaining your reasons.

Please also confirm your complaint reference and keep me appropriately updated if the investigation is not concluded promptly.

Yours faithfully,
[Your name]

Editable template

Version 2: complaint about how personal data was used, shared, secured or recorded

Use this where the problem is the organisation’s handling of your information rather than a failed rights request.

How to edit it: replace everything in square brackets with your own details. If a bracketed paragraph does not apply, delete it before sending.

Subject: Data-protection complaint: [short description]: [reference]

Dear Data Protection Team,

Please treat this as a data-protection complaint about how my personal data has been [used / shared / secured / retained / recorded].

My details
Name: [your name]
Account/reference: [reference]

What happened
[Set out the important events and dates in a short chronology.]

My concerns
1. [specific concern: identify the data and what happened to it]
Evidence: [document/date/reference]

2. [specific concern]
Evidence: [evidence]

Impact
[Explain any relevant consequence, such as an incorrect decision, disclosure, account problem, distress or practical inconvenience.]

Outcome requested
I ask you to:
• investigate each numbered concern;
• [correct / stop / restrict / delete / secure / explain the processing as appropriate];
• explain what happened and the evidence relied on; and
• tell me what action you have taken as a result of the complaint.

Please provide a clear written complaint outcome addressing each issue.

Yours faithfully,
[Your name]

After the complaint

Use the outcome as evidence, not just as correspondence.

If you remain dissatisfied, the ICO will usually expect you to have given the organisation a chance to put things right first. Keep the original complaint and the outcome together; they show exactly what the organisation was asked to investigate.

Official & related guidance

Check the route that applies to your situation.

Check the linked guidance before sending. Rules, complaint stages and time limits can differ by sector.