What counts as a data protection complaint?
A data protection complaint is any expression of dissatisfaction about how you handled that person's own personal data. It does not need to use the word complaint, arrive on your form, or cite the law. Phone, email, post, social media and in person all count.
The definition is deliberately broad
Section 164A(1) lets a data subject complain if they consider there is an infringement in connection with their personal data. There is no formality requirement anywhere in the section, and 164A(2) requires you to facilitate complaints rather than to channel them. So the working definition is: an expression of dissatisfaction about the handling of that person's own personal data.
Examples that count
- An email saying: why are you still emailing me, I asked you to stop months ago.
- A phone call from a former employee asking why their old manager can still see their file.
- A public reply on social media: you shared my address with a courier I never agreed to.
- A sentence at the end of an unrelated letter: I am also unhappy that you kept my medical note.
- A parent at the school gate objecting to a photo of their child on your website.
- A one-star review that names a specific misuse of the reviewer's data, sent to you directly.
Examples that do not count
- General criticism of your privacy policy by someone whose data you do not hold.
- A campaigner complaining about industry practice rather than their own data.
- A complaint about service quality, price or delivery with no data handling element.
- A request for information about how you process data, with no dissatisfaction expressed. That is a query.
If you would rather not run this from a spreadsheet and a shared inbox, use complaint logging software that timestamps receipt, acknowledges automatically and keeps a section 164A complaints log you can hand to the ICO.
Complaint, query or subject access request?
| What arrives | What it is | What you do |
|---|---|---|
| How long do you keep my data? | Query | Answer it. Log it if you like, but no section 164A clock |
| Send me a copy of everything you hold on me | Subject access request | Article 15 route, one month deadline, include the 164A signposting wording |
| You kept my data too long and I want it deleted | Complaint plus erasure request | Run both: section 164A process and the Article 17 request |
| I am unhappy you shared my details with your partner | Complaint | Log, acknowledge within 30 days, investigate, inform the outcome |
| Your website is confusing | Feedback | Not a data protection complaint unless it concerns their own data |
When it is genuinely ambiguous, treat it as a complaint. The cost of logging and acknowledging something that turns out to be a query is a few minutes. The cost of the reverse is a missed statutory deadline you cannot retrospectively fix.
Complaints that arrive by phone or in person
These are the ones that get lost. You cannot forward a conversation. Give staff a fixed habit: write down the date, the person's name and contact details, and what they said in their own words, then send it to whoever owns complaints the same day. Then confirm your understanding back to the complainant in the acknowledgement, so the record is agreed early.
Anonymous and third-party complaints
Section 164A gives the right to the data subject. If someone complains on their behalf, such as a solicitor, parent or advocate, satisfy yourself about authority and then handle it as normal. If a complaint is anonymous you may not be able to acknowledge or respond, but log it, investigate what you can, and record why you could not respond.
Channels you must watch
Because the definition is broad and the 30-day clock starts on receipt anywhere, list every channel a complaint could arrive by and name an owner for each: general inbox, personal work inboxes, contact form, phone line, voicemail, post, each social account, review sites you monitor, and the front desk. That list is a compliance document in its own right.
Prove you met the duty, not just that you meant to
The work in section 164A is operational: spotting the complaint, dating it, acknowledging it within 30 days, keeping the person informed and recording the outcome. PrivacyComplaints does that part for small organisations.