UK ICO data protection complaint

What it does

Complaints about how an organisation has handled your personal information. General customer service complaints only if combined with a data protection concern.

Honest assessment

Be realistic: the modal outcome is that your complaint is logged as intelligence. Its value is cumulative and systemic — the ICO acts on patterns, so a well-evidenced complaint contributes to a case file even when your individual outcome is nil. Do not expect personal redress.

How to file

Raise it with the organisation first and give them a chance to put things right, then complain via ico.org.uk/make-a-complaint. Expect the ICO to ask what the organisation said.

Format

Online form; concise factual narrative plus the organisation's response.

Timing

Rolling. Where you ask the ICO to review how it handled your complaint, a reviewing officer writes to you within 30 calendar days.

What happens after

Outcomes range from recording the complaint for intelligence purposes, to confirming the organisation complied, to asking the organisation to improve practice, to regulatory action in appropriate cases. Most complaints end at the first two.

What it accepts

Complaints about how an organisation has handled your personal information. General customer service complaints only if combined with a data protection concern.

What it does not accept

Non-data-protection grievances. The ICO does not award compensation or obtain individual redress — outcomes are regulatory, not remedial. Compensation requires a court claim.

Operated by

Information Commissioner's Office