What do the new data protection complaint requirements mean for employers?

The new rules are designed to make it easier for individuals to raise concerns directly with organisations about how their personal information has been collected, used, stored or shared. They also encourage organisations to resolve concerns at an early stage, reducing the likelihood that complaints escalate to the Information Commissioner’s Office (ICO).

The requirements apply to any organisation that processes personal data. This means complaints could come from employees, job applicants, customers, service users or anyone else whose information you handle. In this article, we focus on the employer perspective, as employers routinely collect, use and store significant amounts of personal data throughout the employment relationship. However, the same obligations apply regardless of who makes the complaint.

What are the new requirements?

Section 103 of the DUAA requires you to take steps to help individuals make data protection complaints. For example, you may provide a complaint form that people can submit electronically. 

When you receive a complaint, you must acknowledge it within 30 days and tell the complainant of the outcome without undue delay. You should investigate the issues raised, make any necessary enquiries and keep the complainant informed of progress. 

Individuals do not have to complain to you before contacting the ICO. However, the ICO encourages individuals to contact the organisation first. This gives you the opportunity to investigate concerns, resolve problems quickly and potentially avoid regulatory involvement. 

You must update your privacy notice to explain that individuals can complain both to your organisation and the ICO. 

The ICO has published guidance for organisations on how to handle complaints. We explore the key points below.

What is a data protection complaint?

A data protection complaint arises when an individual believes that you have failed to comply with data protection law when handling their personal information. 

Examples include complaints about: 

• how you responded to a subject access request 
• the security measures you use to store personal information
• a personal data breach
• how you collected, stored or shared personal information
• how long you retained personal data
• the accuracy of the personal information you hold

Importantly, the guidance explains that not every complaint involving personal data will amount to a data protection complaint. For example, an employee may raise a grievance while also asking for copies of their personal data. The grievance does not become a data protection complaint simply because the employee has requested copies of their personal information. 

The ICO recognises that it may not always be obvious that an individual is making a data protection complaint. If you are unsure, seek clarification.   

What should you do now?

The new requirements provide a good opportunity to review your existing data protection arrangements and make sure they remain fit for purpose. 

Create a clear route for complaints

You must give individuals a way to make data protection complaints directly to you. 

The ICO suggests that you could: 

• provide a complaint form that can be submitted electronically or in writing and/or;
• provide a dedicated email address for complaints.

However, you cannot require individuals to use a specific form or process. They may raise complaints through a variety of channels. If someone submits a complaint through another route, you should still recognise it and deal with it appropriately. 

Review your privacy notice

You must tell individuals that they can complain to both your organisation and the ICO.  

Include this information in your privacy notice and provide it when you collect personal information. You should also remind individuals of their right to complain when responding to subject access requests.

Put a written procedure in place

The legislation does not prescribe the format of your complaint procedure. However, a written process will help you to deal with complaints consistently and demonstrate compliance. 

Your procedure could explain: 

• how individuals can submit complaints
• where complaints should be directed internally
• what information you may need to investigate a complaint
• how you will investigate complaints
• when you will acknowledge complaints; and
• how you will communicate outcomes.

You may be able to incorporate these requirements into your existing policies and procedures.

Train staff

One of the biggest practical risks is failing to recognise that a data protection complaint has been made. 

A complaint may be received by HR, line managers, recruitment teams, payroll staff or any employee who handles personal information. 

Staff should understand: 

• what a data protection complaint looks like
• how it differs from other workplace complaints
• who they should escalate complaints to; and
• the importance of acting promptly.

Including data protection complaints in your regular data protection training can help staff identify and deal with concerns correctly. 

What should you do when you receive a complaint?

You must acknowledge receipt of a data protection complaint within 30 days and investigate it promptly. 

As part of your investigation, you should investigate the issues raised, gather the relevant information and consider whether you have complied with your data protection obligations. 

The steps you take should reflect the nature and circumstances of the issues raised and you should be able to explain and justify your approach.  

You must also keep the complainant informed of progress. If the investigation is likely to take some time, provide updates so the complainant knows you are actively working to resolve the issue. 

Providing the outcome

Once you have completed your investigation, you must tell the complainant the outcome without undue delay. Explain your findings, the reasons for your decision and any action you have taken.  

Keep clear records of the complaint, your investigation, the outcome and any action you take. 

You should also consider whether the complaint highlights any weaknesses in your processes, training or data protection policies. 

What do these changes mean for employers?

These changes mean you need to have a clear and practical process in place for handling complaints about how you process personal information. 

The key steps are ensuring individuals know how to raise concerns, training staff to recognise complaints when they arise, updating privacy information and putting in place a documented procedure for investigating and responding to complaints. 

We can help you: 

• review your privacy notices
• audit your existing data protection policies and procedures to identify any gaps
• develop or update a data protection complaints procedure
• provide training for HR teams, managers and staff on recognising and handling complaints
• advise on complaints, subject access requests and data protection issues; and
• support you in responding to complaints and engaging with the ICO where concerns escalate.

If you would like support reviewing your current arrangements or dealing with a data protection complaint, please get in touch with Joanne Bone for more information. 

Our newsletters

We publish monthly employment and education newsletters. If you’d like to be added to the mailing list, please let me know.