Data protection complaints policy template
Copy the policy below, replace the bracketed details, and publish it. It covers the four section 164A duties: facilitating complaints, acknowledging within 30 days, investigating and informing the outcome.
How to use this template
- Replace every bracketed field with your own details.
- Publish it on your website at a stable URL and link to it from your privacy notice.
- Name a real person as the owner, not a job title nobody holds.
- Set internal targets you can actually meet, then meet them.
- Review it once a year and record the review date on the page.
Data protection complaints policy
[Organisation name] data protection complaints policy Last reviewed: [date] Owner: [name, role, email] 1. Purpose This policy explains how [organisation name] handles complaints about the way we process personal data. It reflects our duties under section 164A of the Data Protection Act 2018, which applies to complaints we receive on or after 19 June 2026. 2. Who can complain Anyone whose personal data we process can complain to us if they believe there has been an infringement of the UK GDPR or Part 3 of the Data Protection Act 2018 in connection with their personal data. That includes customers, employees, job applicants, suppliers' staff and website visitors. 3. What counts as a complaint We treat any expression of dissatisfaction about how we have handled a person's own personal data as a data protection complaint. It does not have to use the word complaint, arrive on our form or refer to the law. Complaints made by email, post, telephone, social media or in person are all treated the same way. 4. How to complain You can complain: - by completing our complaint form at [URL] - by email to [email address] - by post to [postal address] - by telephone on [number] If you need to complain in another format or need help making a complaint, contact us and we will make reasonable adjustments. 5. What we will do - We will record your complaint and the date we received it. - We will acknowledge receipt within 30 days of receiving it, and normally within [5] working days. The acknowledgement will give you a reference, the name of the person handling your complaint and an expected response date. - We will make enquiries into the subject matter of your complaint. - We will keep you informed of progress, normally at least every [14] days. - We will tell you the outcome of your complaint, and any action we have taken, without undue delay. Our internal target is [30] days from receipt for straightforward complaints and [60] days where the complaint is complex. If we need longer we will tell you why and give you a revised date. 6. Our decision We will address each part of your complaint and tell you whether we have upheld it, partly upheld it or not upheld it, and why. Where we have got something wrong we will say so and explain what we are changing. 7. If you are not satisfied You can ask us to review our decision by contacting [name, email]. You can also complain to the Information Commissioner's Office at any time, and you do not have to complain to us first: Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF ico.org.uk/make-a-complaint 8. Records We keep a record of every data protection complaint, including the date received, the date acknowledged, the enquiries we made, the outcome and the date we told you the outcome. We keep these records for [3] years. 9. Review This policy is reviewed annually and whenever the law or our processes change.
Fields you must not leave blank
| Field | Why it matters |
|---|---|
| At least two contact routes | Section 164A(2) expects an electronic route and another means |
| Named owner | Complaints stall when nobody owns them by name |
| Acknowledgement target | Your own target is your defence against a late acknowledgement |
| Update rhythm | Keeping the person informed is named in section 164A(5) |
| ICO signposting | Section 165 route must be visible, not hidden |
Prove you met the duty, not just that you meant to
The work in section 164A is operational: spotting the complaint, dating it, acknowledging it within 30 days, keeping the person informed and recording the outcome. PrivacyComplaints does that part for small organisations.