Data Handling Complaints Process

1 Purpose and legal framework

This process establishes a fair, accessible and accountable way to raise concerns about the handling of personal data. DPS must identify the concern, investigate appropriately, explain its decision and remedy failings. No person may be disadvantaged for making a complaint in good faith. Complaints are handled free of charge.

The controller is Data Privacy and Data Security Services Limited, a Cypriot company, HE 432380, at Griva Digeni, 51 Athineon Court, Office 202, 8047, Paphos, Cyprus. The Data Protection Officer (DPO) can be contacted at info@dataprivacyservices.co.uk.

For processing subject to UK law, this procedure implements section 164A of the Data Protection Act 2018, inserted by section 103 of the Data (Use and Access) Act 2025, alongside the UK GDPR. The new complaints duty took effect on 19 June 2026. It requires a means of complaining, acknowledgement within 30 days, appropriate enquiries and progress information without undue delay, and an outcome without undue delay. These duties begin at receipt; acknowledgement is not permission to defer investigation.

As an EU-established controller, DPS must also observe EU GDPR and applicable Cypriot law. The DPO records which laws apply to the processing, considering establishment and territorial scope. A complainant’s nationality alone does not determine applicability. DPS adopts this service standard for all in-scope complaints while preserving each applicable legal right.

2 Scope and responsibilities

The process covers website visitor information, enquiries, demonstrations, quotations, business communications, marketing preferences and privacy case records where DPS determines the purposes and means of processing. Concerns may include insecure disclosure, excessive collection, inaccurate records, unwanted marketing, retention, lack of transparency, rights handling or inappropriate automated decisions.

Workspace processing has separate privacy policies. When DPS acts only as a processor, the DPO promptly routes the complaint securely to the customer controller and supports its investigation under contractual instructions. DPS does not independently decide the customer’s complaint or disclose tenant information without authority. Mixed cases retain a separate DPS controller investigation. Separate workspace policies must not be used to dismiss DPS’s own responsibilities.

All staff and contractors forward complaints to the DPO within one working day, preserve relevant material and flag urgent risks immediately.
The DPO assigns a case owner, confirms jurisdiction, oversees deadlines and approves privacy findings. A trained deputy monitors the inbox during absence.
IT, record owners and providers supply relevant evidence and implement assigned remedies. Directors provide resources and independently review cases involving the DPO or a conflict of interest.

3 Receiving and recognising complaints

A complaint is an expression of dissatisfaction suggesting that personal data has been handled contrary to data protection requirements. No legal terminology or prescribed form is needed. Staff must recognise complaints embedded in ordinary correspondence, a rights request or a wider service dispute, and handle the privacy component promptly.

Recommended route: email the DPO at info@dataprivacyservices.co.uk, preferably headed “Data handling complaint”. Postal complaints may be sent to the registered address, marked “Data Protection Officer”. Accept complaints reaching any normal business contact channel, including oral complaints and monitored business social media. Move discussions off public channels before discussing personal details.

Record an oral complaint accurately, repeat the substance to confirm understanding and agree a safe contact method. Offer help completing the form, an accessible format or an alternative communication method. Use age-appropriate language and assess authority and competence where a child or person requiring assistance is involved.

Register the actual receipt date, channel, original complaint, reference, safe contact details, subject, desired remedy if known, case owner and acknowledgement deadline. Receipt is not postponed until the DPO reads the message. Anonymous reports still receive a risk assessment; where no reply channel exists, record that limitation.

4 Acknowledgement and time management

Acknowledge within 30 calendar days. The period starts the day after receipt, including weekends and public holidays. If the final day is a weekend or public holiday, the legal acknowledgement deadline moves to the next working day. DPS aims to acknowledge within three working days and plans ahead of the legal deadline. Record evidence of sending or an oral acknowledgement.

The acknowledgement states the case reference, issues understood, responsible contact, next steps and expected update or outcome date. Ask promptly for essential clarification. Missing clarification, identity checks, referral to a provider or an internal transfer do not automatically suspend the acknowledgement deadline. A sufficiently prompt outcome may also acknowledge receipt.

There is no universal statutory 30-day completion deadline under section 164A. DPS aims to resolve cases within 30 calendar days of receipt, but must act sooner where reasonably possible. For a complex case, document the reason, proportionate enquiries, harm risk and realistic completion date. Give an update at least every ten working days while open, and sooner when a material development or delay arises. These are internal targets, not legal extensions or permission for avoidable delay.

The case owner checks open cases weekly. Escalate a threatened legal deadline, unexplained delay or ongoing harm to the DPO and director immediately. Staff absence, workload and supplier delay require active management. Tell the complainant why a date has changed and give a revised date; do not silently roll it forward.

5 Triage and related obligations

At intake, assess immediate harm, security exposure, vulnerability, relevant rights requests, customer-controller involvement and any conflict of interest. Assign urgent containment where needed. A complaint must not wait for the conclusion of unrelated commercial, disciplinary or contractual disputes.

If the facts indicate a possible personal data breach, activate incident management immediately. Assess notification duties independently: where required, notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of awareness; notify affected people without undue delay where the applicable high-risk test is met. The complaints timetable does not replace these obligations.

If the complaint includes access, erasure, rectification, restriction, objection or another rights request, open a linked rights case and apply its own legal tests and deadlines. A complaint investigation does not pause a DSAR deadline. Stop direct marketing processing when a valid objection requires this, rather than awaiting complaint closure.

Use existing trusted information to establish identity where sufficient. Ask only for proportionate evidence where there is reasonable doubt, and verify a representative’s authority before investigating the represented person’s case or disclosing information to the representative. Meanwhile acknowledge receipt and assess any independent security or systemic risk. Do not routinely demand passports or proof of address. Keep identity evidence securely and delete it when no longer needed.

6 Investigation and evidence

The case owner prepares an investigation plan identifying each allegation, relevant processing, custodians and systems, questions to answer, evidence needed and action dates. The extent of enquiry must be appropriate to the circumstances, including the seriousness of harm. A clear record must explain any justified limit; disagreement with the complainant is not a reason to avoid investigation.

Preserve relevant emails, records, audit trails, privacy notices, permissions, marketing records, contracts, rights correspondence and incident records. Use a targeted hold where routine deletion would destroy necessary evidence. Document provenance, access and any gaps. Staff must not alter or remove records to frustrate the investigation.

Seek the complainant’s account and relevant staff or supplier explanations. Compare actual practice with the applicable law, disclosed purposes, lawful basis, data minimisation, retention, security and rights obligations. Separate established facts, conflicting evidence and assumptions. Do not assume that the website creates a server-side enquiry record: the current form prepares an email in the visitor’s browser; check received messages and relevant hosting logs independently.

Access to complaint material is limited to those who need it. Share only necessary information with providers or customer controllers through secure channels, under the applicable agreement and lawful transfer arrangements. Do not expose another tenant’s data. Obtain legal advice for contested exemptions, privilege, cross-border issues, serious harm or potential compensation claims.

Where a complainant stops responding, follow up reasonably, investigate what can safely be established and explain any remaining limitation. Record a reasoned outcome rather than treating silence as proof that the allegation is unfounded. For abusive communication, manage channel or contact frequency proportionately while preserving consideration of the substantive concern; do not apply DSAR refusal tests automatically to complaints.

7 Outcome and corrective action

Send the outcome as soon as the investigation permits. The DPO or an appropriate independent reviewer checks that each issue has been addressed, the evidence supports the findings and disclosure is safe. Use clear language and the agreed accessible format; retain delivery evidence. Confirm a telephone resolution in writing where practicable.

Identify the complaint and describe the enquiries, established facts and relevant requirements, with enough detail to explain the decision.
State whether each issue is upheld, partly upheld or not upheld; explain any evidence limitation without claiming certainty that the evidence does not support.
Describe remedies already taken and further actions, their owners and completion dates. Give an apology where appropriate and explain the safe next steps for the individual.
Include the DPO contact, internal review option, competent regulator route and the preservation of judicial remedies. Restrict another person’s information or privileged material only where justified, explaining limitations as far as lawfully possible.

Possible remedies include correcting records, stopping unlawful processing, completing an overdue rights response, improving access controls, amending notices or retention rules, training staff and directing a supplier to remedy a failing. Do not promise compensation or a regulatory determination without authority. Send an available privacy outcome even if other elements of a wider dispute remain unresolved.

Close the complaint decision only after recording the outcome. Track outstanding corrective actions separately until completion is verified; closing correspondence must not imply that unfinished remediation has been completed.

8 Review and regulator escalation

A person dissatisfied with the outcome may request review through info@dataprivacyservices.co.uk. There is no mandatory short window for seeking this internal review. A director or other suitable reviewer not responsible for the original decision reviews the evidence, reasoning and any new information where practicable. Use the acknowledgement and update standards above and explain the review outcome without undue delay.

For UK data protection matters, the complainant may contact the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/. The ICO normally encourages people to raise concerns with the organisation first, but they do not have to await an internal review and may contact the ICO at any point. DPS must not make internal exhaustion, use of its form, withdrawal of a claim or a confidentiality undertaking a condition of escalation.

For EU GDPR matters, provide the appropriate supervisory authority route. The Cyprus Commissioner for Personal Data Protection is available through https://www.gov.cy/dataprotection/en/. EU GDPR Article 77 also permits a complaint to a supervisory authority in the person’s habitual residence, place of work or place of the alleged infringement. A Cyprus route does not displace the ICO’s competence for UK processing. Regulatory complaints and internal review do not remove applicable court remedies.

The DPO coordinates truthful, timely cooperation with a competent authority, preserves requested evidence and monitors regulator instructions. Record regulator correspondence and do not retaliate against the complainant.

9 Records, retention and improvement

Maintain a restricted complaints register recording reference; actual receipt; issues and jurisdiction; controller or processor role; owner; acknowledgement due and sent dates; identity or authority decision; urgent risks; enquiries and evidence; updates and revised dates; outcome and reasons; approval; review or regulator involvement; remedies; closure; and retention review date.

Complaint records may contain sensitive personal information. Record an appropriate lawful basis for administration: legal obligation where an applicable duty supports it, otherwise an assessed legitimate interest where appropriate. Identify a separate valid condition before processing special-category or criminal-offence data. Minimise collection, use secure repositories and communicate through verified channels. Explain complaint-record handling in the relevant privacy information.

Apply a documented retention schedule reflecting case needs, applicable limitation periods and regulator or litigation holds. There is no universal DUAA complaints retention period. Before this process becomes effective, the DPO must approve and record the case retention period and rationale; review at least annually and delete or anonymise securely when no longer required. Retain only minimal verification outcomes where possible, rather than copies of identity documents.

Report quarterly to management on complaint themes, acknowledgement compliance, time to resolution, unexplained delays, upheld issues, recurring causes and overdue remedies using aggregated information where possible. Assess root causes and assign improvements. Train staff at induction and periodically thereafter; review this process annually and after a serious complaint or material legal change.

10 Implementation checklist

Approve this process and appoint the case owner, deputy and independent review contact.
Monitor the DPO inbox and business contact channels; establish cover and staff forwarding arrangements.
Add the controller complaint route to privacy information at collection and to DSAR responses, alongside the applicable regulator route. Publish the complaint contact route; do not publish confidential case-handling records.
Create the restricted register, calendar alerts, evidence repository and approved retention schedule; agree supplier assistance arrangements.
Brief staff on recognition, immediate escalation, secure communication and separate rights or breach deadlines. Check periodically that routes work and sample completed cases for compliance.