Data Protection Complaints Procedure

Introduction

This procedure sets out how Wirral Council will handle complaints relating to our processing of personal data, in line with our obligations under the Data (Use and Access) Act (DUAA) 2025.

This procedure applies to complaints from any individual who believes that the Council have infringed data protection law in the way we have collected, used, stored, shared, retained, secured or otherwise handled their personal data. It applies to complaints received from customers, service users, employees, workers, contractors, former staff, applicants, suppliers, website users and any other individual whose personal data we process. This procedure is designed to support compliance with the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025, including the requirement to provide a process for handling data protection complaints.

What is a data protection complaint?

A data protection complaint is any expression of dissatisfaction or concern that relates to the way we have handled personal data or complied with data protection law. This may include concerns about how we responded to a data subject access request or other rights request, the lawfulness of processing, the accuracy of personal data, retention, security, disclosure to third parties, direct marketing, international transfers, or the handling of a personal data breach. A person does not need to use legal terms or mention specific legislation for a concern to amount to a data protection complaint. If it is unclear whether a concern is a complaint under this procedure, we will clarify this with the individual where appropriate.

How to make a complaint

You can submit a complaint if you believe:

  • We have mishandled your personal data
  • We have not complied with data protection laws
  • We have failed to respond to a data rights request appropriately

Complaints can be made via:

Please include as a minimum:

  • Your name and contact details
  • Details of your complaint
  • Any relevant evidence or correspondence

Receipt and acknowledgement

We will record the date a complaint is received and acknowledge receipt within 30 days.

The acknowledgement will confirm that the complaint has been received, explain the next steps, identify the contact point for communications where appropriate, and request any information reasonably needed to understand the complaint. If clarification is required, we will request only information that is relevant and proportionate to the issues raised.

Please note that, at this stage, and only if required, we may request additional ID verification documents to ensure that we are responding to the correct person or representative.

Investigation and Communications

We will take appropriate steps to investigate each complaint without undue delay. What is appropriate will depend on the nature, complexity and seriousness of the issues raised, including any risk of harm to the complainant. Investigative steps may include reviewing relevant systems and records, speaking to staff, checking decisions taken in relation to the complainant’s personal data, assessing whether any breach of law or internal policy has occurred, and considering whether urgent containment or remedial action is needed. We will keep the complainant informed of progress where the matter cannot be resolved quickly, including expected timeframes and reasons for any delay.

Your complaint will be reviewed by the council’s Information Governance team.

We will aim to resolve your complaint within three months of receipt, as required by the DUAA.

If we need more time due to complexity, we will inform you in writing, explaining the reason and expected timeframe.

Outcome and Remedies

We will inform you of the outcome of the complaint without undue delay once our investigation is complete. The outcome will explain our decision in clear language and, where relevant, set out any action we have taken or will take. This may include correcting or deleting personal data, restricting processing, improving internal processes, providing further explanation, offering an apology, retraining staff, or taking other appropriate remedial action. If we do not uphold the complaint, we will explain why.

Right to Complain to the ICO

If you are not satisfied with our response, you can contact the ICO:

Record Keeping

We will keep an internal record of data protection complaints, including the date received, the issues raised, key actions taken, the date of acknowledgement, correspondence with the complainant, the outcome, and any follow-up actions. Records will be retained in line with our retention schedule and used to identify trends, improve compliance, and demonstrate accountability. Records will be retained for at least three years in accordance with DUAA requirements.

Accessibility and Fairness

We will handle complaints fairly, objectively and in a way that is proportionate to the circumstances. No one will be disadvantaged for raising a genuine data protection concern.

Training, Monitoring and Review

Relevant staff will receive training so they can recognise and escalate data protection complaints appropriately. We will monitor the operation of this procedure, review complaint trends and outcomes, and update this procedure when there are changes to the law,
regulatory guidance or our organisational arrangements. This procedure will be reviewed at least annually.

The council also has the following associated documents:

Data Protection Policy
Principal Privacy Notice

Dated: June 2026. Next review date: June 2027.