Data Protection Complaints Handling Policy (Jun26)

Compliance with Section 103 of the Data (Use and Access) Act 2025

About This Procedure

The person responsible for this procedure is Timothy Halliday [Data Protection Manager]. Report any concerns about how the firm handles personal data complaints to this person. If the DPM is unavailable, report to Elizabeth Collins or Nicola Robinson.

All staff and other associated persons who have access to this procedure must comply with its requirements.

Failure to comply may be treated as gross misconduct and result in disciplinary action, in addition to any professional or criminal sanctions that may apply.

1. Purpose and Scope

This procedure sets out how The Eric Whitehead Partnership receives, acknowledges, investigates and resolves complaints from individuals about the way the firm processes their personal data. It ensures compliance with the mandatory complaints handling requirements introduced by section 103 of the Data (Use and Access) Act 2025, which inserts a new section 164A into the Data Protection Act 2018.

This procedure applies to all data protection complaints received by the firm, whether made by clients, employees, third parties or their authorised representatives.

A data protection complaint is any expression of dissatisfaction from an individual who considers that the firm has infringed data protection legislation in the way it has handled their personal information. This includes complaints about:

How personal data has been collected, stored, used, shared or deleted
The firm’s response to a subject access request or other data subject rights request
The security of personal data, including suspected data breaches
The accuracy of personal data held by the firm
Direct marketing or electronic communications
Automated decision-making or profiling
International transfers of personal data

This procedure does not cover general service complaints, which are handled under the firm’s Complaints and Reporting Policy. Where a complaint covers both service and data protection matters, both procedures must be followed in parallel.

This procedure applies to all partners, solicitors, non-qualified staff, consultants, locums, contractors and any other person processing personal data on behalf of the firm.

2. Roles and Responsibilities

2.1 Data Protection Manager (DPM)

The DPM has overall responsibility for the operation and oversight of this procedure, including:

Final decisions on complaint outcomes where escalation is required
Maintaining the complaints register and reporting to the Directors of the firm
Liaising with the ICO where complaints are escalated externally
Reviewing complaint trends and recommending improvements
Logging, acknowledging and tracking all complaints
Allocating complaints to the appropriate investigator
Ensuring acknowledgement and response deadlines are met
Maintaining communication with the complainant throughout the process

2.2 All Staff

All staff must:

Recognise and promptly escalate potential data protection complaints to the DPM
Cooperate with investigations and provide information as required
Complete mandatory training on data protection complaints handling
Not make admissions or commitments to complainants without consulting the DPM

3. Complaints Handling Procedure

3.1 How to Make a Complaint

Individuals may make a data protection complaint to the firm through any of the following channels:

Email: clientcare@ericwhitehead.co.uk
Post: Data Protection Complaints, The Eric Whitehead Partnership, St Giles’ Chambers, 14-16 Chapel Street, Cheadle, Staffordshire ST10 1DY.
Telephone: 01538 755761 (complaints made by telephone must be followed up in writing)
In person: At any of the firm’s offices, addressed to the Data Protection Manager

Complaints may be made by the data subject directly or by an authorised representative. Where a representative submits a complaint, the firm must verify their authority to act before disclosing personal data.

The right to make a data protection complaint must be communicated to individuals through the firm’s privacy notice, responses to data subject rights requests, the firm’s website, and client engagement letters where appropriate.

3.2 Step 1 — Receipt and Logging

All data protection complaints must be logged on the data protection complaints register immediately upon receipt. The complaints register is the complaints module in Access Compliance and the following information must be recorded:

Date and time of receipt
Name and contact details of the complainant (and representative, if applicable)
Channel through which the complaint was received
Summary of the complaint, including the personal data and processing activities in question
Unique reference number assigned to the complaint

If it is unclear whether a communication constitutes a data protection complaint, treat it as one. The ICO expects complaints to be interpreted broadly.

3.3 Step 2 — Acknowledgement

The firm must acknowledge receipt of the complaint within 30 calendar days. The 30-day period begins the day after receipt, regardless of whether that day falls on a weekend or bank holiday. Where the 30th day falls on a non-business day, the firm has until the next working day to issue the acknowledgement.

The acknowledgement must:

Confirm receipt of the complaint and provide the reference number
Identify the DPM as the point of contact
Provide an indication of the expected timeframe for investigation and response
Inform the complainant of their right to complain to the ICO if they are dissatisfied with the outcome

Best practice is to acknowledge complaints within five working days. The 30-day period is a statutory maximum, not a target.

3.4 Step 3 — Investigation

The duty to investigate begins when the complaint is received, not when the acknowledgement period expires. The firm must take appropriate steps to investigate without undue delay, including:

Reviewing the personal data and processing activities that are the subject of the complaint
Gathering relevant information from internal teams, systems and records
Consulting the DPM or external advisers where the complaint raises complex or novel issues
Considering whether the complaint reveals a personal data breach requiring separate notification under Articles 33 and 34 UK GDPR
Considering whether other data subjects may be affected by the same issue

The investigation must be proportionate to the nature and seriousness of the complaint. Simple complaints may be resolved immediately. Complex complaints will require a more detailed investigation.

Target timeframe: The firm aims to complete investigations and provide a final response within 30 days of receipt. Where this is not possible, the complainant must be provided with a progress update explaining the reason for the delay and a revised timeframe.

3.5 Step 4 — Outcome and Response

The firm must inform the complainant of the outcome without undue delay. The outcome communication must include:

A clear explanation of the findings of the investigation
What action the firm has taken or will take in response
The reasons for the decision, particularly if the complaint is not upheld
Information about the complainant’s right to escalate the complaint to the ICO, including:
ICO website: ico.org.uk/make-a-complaint
ICO helpline: 0303 123 1113
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

The outcome must be communicated in writing. Where the complaint was made verbally, the outcome must still be confirmed in writing.

3.6 Complaints Involving Data Processors

Where a complaint relates to processing carried out by a third-party data processor on behalf of the firm, the complaints coordinator must:

Notify the processor of the complaint and request relevant information to support the investigation
Ensure the data processing agreement requires the processor to cooperate with complaint investigations
Remain responsible for communicating with the complainant — the firm as controller is accountable for the response

Where a complaint is misdirected to the firm but relates to processing for which another organisation is the controller, the firm must inform the complainant promptly and, where possible, redirect the complaint to the correct organisation.

3.7 Complaints Involving Children

Complaints from or about children must be handled with particular care. The firm must respond in plain, clear language and assess the child’s competence to understand and exercise their rights. Where the firm is subject to the Age Appropriate Design Code, it must ensure compliance with the requirements in Standard 15 of that code.

4. Record-Keeping and Monitoring

4.1 Complaints Register

The firm must maintain a comprehensive complaints register recording all data protection complaints and the steps taken to resolve them. The register must include:

Complaint reference number, date received and channel of receipt
Identity of the complainant and their representative (if any)
Summary of the complaint and the personal data or processing at issue
Date of acknowledgement
Details of the investigation undertaken, including evidence reviewed and persons consulted
Outcome and date of the final response
Any remedial action taken
Whether the complaint was escalated to the ICO
Lessons learned and any systemic improvements identified

Complaint records must be retained for 6 years and stored securely in compliance with the firm’s data protection policies.

4.2 Monitoring and Reporting

The DPM must report to the Directors on a monthly basis, covering:

Total number of complaints received in the period
Breakdown by complaint type, channel and business area
Acknowledgement and response times against targets
Outcomes: upheld, partially upheld, not upheld
Remedial actions taken and systemic improvements implemented
Any complaints escalated to the ICO and their status
Trends and emerging risks identified from complaint data

The Secretary of State may introduce regulations requiring controllers to report complaint data to the ICO. The firm must maintain records in a format that can be disclosed on request.

4.3 Training

All staff must receive training on this procedure as part of their data protection induction, with annual refresher training thereafter. Training must cover how to recognise a data protection complaint, the requirement to escalate complaints immediately, the statutory timeframes, and the importance of not making admissions without consulting the DPM.

Training completion must be recorded and monitored. The DPM is responsible for ensuring training materials are updated following any changes to legislation, ICO guidance or this procedure.

4.4 Interaction with Other Procedures

Where a data protection complaint also engages another firm procedure, both must be followed in parallel. Key interactions include:

Complaints and Reporting Policy — where a complaint also raises service quality issues under the SRA Standards and Regulations
Data Protection Breach Reporting Procedure — where a complaint reveals a personal data breach requiring notification under Articles 33/34 UK GDPR
Data Subject Access Request Policy — where a complaint relates to the handling of a SAR or other data subject rights request
Whistleblowing Policy — where a complaint raises concerns that may also constitute a protected disclosure

5. Regulatory Framework and References

5.1 Legislation

Data Protection Act 2018, section 164A (as inserted by DUAA section 103) — statutory duty to facilitate and respond to data protection complaints
Data (Use and Access) Act 2025, section 103 — the provision inserting the new complaints duty into the DPA 2018
UK General Data Protection Regulation, Article 77 — the right of data subjects to lodge a complaint with a supervisory authority
UK GDPR, Articles 33 and 34 — data breach notification obligations (where a complaint reveals a breach)

5.2 SRA Standards and Regulations

This procedure supports compliance with:

SRA Principle 2 — public trust and confidence (handling complaints transparently)
SRA Principle 5 — integrity (responding honestly to complaints)
SRA Principle 7 — best interests of each client
SRA Code of Conduct for Firms, paragraph 2.1 — effective governance structures, arrangements, systems and controls

5.3 Regulatory Guidance

ICO guidance: ‘How to deal with data protection complaints’ (published 12 February 2026)

Next review date: June 2027 or sooner if there are changes to data protection legislation, ICO guidance, or the firm’s data processing activities.

June 2026

Go Back