Data Protection Complaints Procedure (DUAA – Effective 19 June 2026)

Purpose This procedure explains how individuals can raise concerns about how their personal information is collected, used, stored, or shared. It meets the requirements of the Data Use and Access Act 2025 (DUAA) and associated ICO guidance (February 2026).

1. How individuals can make a complaint

Individuals may raise a data protection complaint. I will accept complaints made:

• Using a data protection complaint form 
• By email
• By telephone
• In writing
• Through our website or online portal
• Via social media
• In person (where applicable)

We will never refuse a complaint because it was not submitted through the “official” route.

2. Information we may need

To help us investigate, I may ask for:

• The nature of the concern
• Relevant dates, interactions, or evidence
• What outcome the individual is seeking
• Proof of identity (if needed to confirm who we are communicating with)
• A letter of authority or power of attorney if someone is acting on another person’s behalf

We will request this information as early as possible.

3. Acknowledging the complaint

I will:

• Acknowledge all data protection complaints within 30 days
• Confirm who is handling the complaint
• Explain the next steps and expected timescales

If the complaint is from a child or young person, we will assess their competence to exercise their rights and adapt our communication accordingly.

4. Investigating the complaint

I will:

• Review the issues raised and any relevant records
• Speak with staff involved (if applicable)
• Assess whether our data handling complied with DUAA and ICO guidance
• Identify any risks, errors, or areas for improvement
• Keep the individual updated if the investigation takes longer than expected

5. Responding to the complaint

I will provide a written response that includes:

• The outcome of our investigation
• Any actions I have taken or will take
• Any learning or improvements identified
• Information on the individual’s right to escalate the matter

6. If the individual is not satisfied

If the individual remains unhappy with our response, they may:

• Ask us to review the decision
• Raise their concern with the Information Commissioner’s Office (ICO)

I will provide the ICO’s contact details in our response.

7. Recording and learning

I will:

• Log all data protection complaints
• Record outcomes and actions taken
• Identify themes or recurring issues
• Use learning to improve our data protection practices, staff training, and member/patient communications

8. Staff responsibilities

All staff must:

• Know how to recognise a data protection complaint
• Forward complaints immediately to the Data Protection Lead
• Support investigations promptly and transparently
• Complete any required training on DUAA and complaint handling