Section 164A for schools and academy trusts
Schools already run a general complaints procedure, and that is the risk. A data protection complaint has its own statutory 30-day acknowledgement deadline and must not be absorbed into a multi-stage governor process.
Does section 164A apply to you?
The school, academy or trust is the controller of pupil, parent and staff data. Multi-academy trusts should decide centrally who acknowledges and who investigates.
The complaints you are most likely to get
- Pupil records or SEN information shared with the wrong parent or staff member
- Photographs and videos of pupils published without a valid consent record
- Parental separation cases where one parent receives the other's details
- Safeguarding records disclosed more widely than necessary
- Staff data in governor papers or on shared drives
Channels to watch
The 30-day clock starts when a complaint reaches your organisation by any route, so every channel below needs a named owner.
- The school office inbox and phone
- Class teachers and teaching assistants in person and at the gate
- Parent messaging apps and portals
- The general complaints form on the school website
- Letters to the headteacher or clerk to governors
Worked examples
| What arrives | How to treat it |
|---|---|
| A parent emails the office objecting that their child's medical information was read aloud in class | A complaint. Acknowledge within 30 days, investigate with the staff involved, tell them the outcome |
| A stage 1 general complaint form arrives that is really about data sharing | Run the section 164A process in parallel. Do not let stage timings delay the acknowledgement |
| A member of staff complains their absence reason was discussed in a meeting | A staff data protection complaint. Same duties, and usually needs HR and DPO input |
A minimum viable process
- Publish a complaints route with an electronic option and another means. Use the complaints policy template.
- Add the section 164A wording to your privacy notice and your subject access request template. Use the privacy notice wording.
- Log every complaint with the date it was received. Use the complaints log template.
- Acknowledge within days, not weeks. See the 30-day acknowledgement rule.
- Investigate, update the person, decide, tell them the outcome and signpost the ICO. See how to handle a data protection complaint.
Prove you met the duty, not just that you meant to
The work in section 164A is operational: spotting the complaint, dating it, acknowledging it within 30 days, keeping the person informed and recording the outcome. PrivacyComplaints does that part for small organisations.