Read our guidance
Before you make a complaint, read our guidance about making a SAR to check if the organisation has followed the law.
Sometimes you might be unhappy with the outcome of your request, but the organisation has done everything they have to do.
Complain to the organisation
You can resolve many problems directly with the organisation.
If it has been over one month since you made your request and you’ve not heard from the organisation, you should send them a follow up email or letter.
If you’ve already received a response to your SAR, but are unhappy for any reason, you should firstcomplain to the organisation. We recommend that you do this by email, where possible.
If you think personal information is missing from the response, you should clearly list what other information you think they also have. This will help them review their records.
Remember to keep copies of any letters or emails about your complaint, or written records about any calls or meetings you’ve had, as evidence.
You could use the following complaint letter or email template as a guide, adding in the details of your own complaint:
[Your full address]
[Phone number]
[date]
[Name and address of the organisation]
[Reference number (if the organisation has given you one)]
Dear [Sir or Madam / name of the person you have been in contact with]
Subject access request complaint
[Your full name and address and any other details such as account number so they know who you are]
I’m concerned you haven’t done everything you’re meant to.
[Give details of your complaint clearly and simply and, if needed, its effect on you.
Examples of what you may wish to say are:
You haven’t sent me the following information:
[List clearly what other information you think they still have]
You’ve removed or blacked out information and you haven’t explained why.
[Give details of the email or document where they’ve removed or blacked out information.]
I understand that before reporting my complaint to the Information Commissioner’s Office (ICO) I should give you the chance to deal with it.
I’ll give a copy of your reply to the ICO if I decide I still want to report my complaint to them.
You can find guidance on what you’re meant to do if you receive a subject access request on the ICO’s website (www.ico.org.uk or https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/helping-you-find-subject-access-request-resources/). There’s also information on their regulatory powers and the action they can take.
Please respond fully within one calendar month. If you can’t reply within that time, please tell me when you will be able to reply.
If you’d like to discuss this, please contact me on [telephone number / email address].
Yours sincerely
[Signature]
Complain to the ICO
Once you have followed the steps above, you canmake a complaint to us
You should raise your complaints with us within three months of your last meaningful contact with the organisation.
Remember to send us copies of all the key documents you have kept as evidence to support your complaint.
We cannot:
- act as your representative; or
- award compensation.
The ICO can punish an organisation for breaking the law, but we only use this power in the most serious cases. If we think the organisation has not responded to your request as they should’ve done, we can give them advice and ask them to solve the problem.
You can also seek to enforce your rights through the courts. If you decide to do this, we strongly advise you to seek independent legal advice first. We cannot help you with this process.
