Section 164A for ecommerce and online retail
Online retailers get the highest volume of section 164A complaints, because marketing, tracking and account data touch every customer. The duty is the same, but the volume means it has to be systematic.
Does section 164A apply to you?
You are the controller of your customer accounts, order history, marketing lists and website analytics, even where a platform or an agency operates them for you.
The complaints you are most likely to get
- Marketing emails after an unsubscribe, or after account closure
- Abandoned basket emails to people who never completed a purchase
- Account deletion requests that leave order data visible
- Advertising pixels and audience uploads to advertising platforms
- Reviews published with more of the customer's name than they expected
Channels to watch
The 30-day clock starts when a complaint reaches your organisation by any route, so every channel below needs a named owner.
- The support helpdesk, where complaints look like tickets
- Replies to marketing emails, which often route to an unmonitored address
- Live chat transcripts
- Marketplace messaging on third-party platforms
- Social media, where complaints are public and fast
Worked examples
| What arrives | How to treat it |
|---|---|
| A customer says: I deleted my account, why am I still getting offers | A complaint plus an erasure question. Acknowledge, trace the list the email came from, and report what you fixed |
| A shopper objects to their email being uploaded to an advertising audience | A complaint about sharing. Check what your tag manager and marketing platform actually send |
| A support ticket tagged as billing that ends: and you should not still have my old address | A complaint hidden inside a service ticket. Your triage has to catch this |
A minimum viable process
- Publish a complaints route with an electronic option and another means. Use the complaints policy template.
- Add the section 164A wording to your privacy notice and your subject access request template. Use the privacy notice wording.
- Log every complaint with the date it was received. Use the complaints log template.
- Acknowledge within days, not weeks. See the 30-day acknowledgement rule.
- Investigate, update the person, decide, tell them the outcome and signpost the ICO. See how to handle a data protection complaint.
Prove you met the duty, not just that you meant to
The work in section 164A is operational: spotting the complaint, dating it, acknowledging it within 30 days, keeping the person informed and recording the outcome. PrivacyComplaints does that part for small organisations.