Information Commissioner's Office (ICO)

Ways to reach them

Make a complaint · Complaint route

https://ico.org.uk/make-a-complaint/

Verified · 2026-09-22

Complaints about how an organisation handled your personal information, including AI training on your data and automated decisions about you. Sub-routes include nuisance calls (https://ico.org.uk/for-the-public/nuisance-calls/) and FOI complaints.

VERIFIED — page fetched; it is a hub that routes by complaint type. The ICO's contact pages are JavaScript-heavy and the helpline number could not be read off them directly.

Concerns about how an organisation handled your information · Complaint route

https://ico.org.uk/for-the-public/i-m-worried-about-how-an-organisation-has-handled-my-information/

Unverified

The public-facing entry point for a data-protection concern.

UNVERIFIED as fetched; appeared in ICO search results.

ICO helpline and live chat · Web form

https://ico.org.uk/global/contact-us/

Verified · 2026-09-22

ICO operates a telephone helpline and live chat for the public.

PARTIALLY VERIFIED — the page loaded and confirmed a helpline and live chat exist (it carried a notice about closure on specific bank holidays) but the phone number itself did not render to the retrieval tool. Read it from the page directly rather than trusting a remembered number.

ICO calls for views and draft guidance consultations · Public consultation

https://ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/

Unverified

The ICO consults on AI and data protection guidance, generative AI, and biometrics.

UNVERIFIED as fetched; confirm from the ICO site navigation.

Homepage · Homepage

https://ico.org.uk/

Unchecked

What it does

Independent data protection and information rights regulator. Enforces UK GDPR and the Data Protection Act 2018, which govern AI training data, automated decision-making and profiling (Article 22 rights), and data subject rights. Can issue information notices and assessment notices, conduct audits, issue enforcement notices requiring a company to stop processing (including stopping a model's deployment), and fine up to £17.5m or 4% of global turnover. Also enforces PECR. Publishes AI and data protection guidance and runs a regulatory sandbox.

Its powers

fine

Honest assessment

The ICO complaint route is real and heavily used, but the practitioner experience is that individual complaints usually end in advice or a 'we have asked the organisation to improve' letter rather than enforcement; the ICO has been notably reluctant to fine large technology firms. The effective lever is the ICO's consultation and call-for-views process on AI guidance, where structured responses visibly move the text, and coordinated complaints that establish a pattern. Scope is personal data and automated decisions about individuals — NOT frontier or catastrophic risk. The ICO also has no jurisdiction over a model that harms no identifiable data subject.

Notes