Data protection complaints procedure

A data protection complaint is when you raise a concern about how we have collected, used, shared or stored your personal data.

This includes situations where you believe we have not handled your personal information correctly, securely or lawfully under the UK GDPR or the Data Protection Act 2018.

Your complaint may relate to things like:

• we use incorrect or incomplete personal data about you
• we share your personal data without a lawful basis
• we keep your personal data for longer than necessary
• we do not respond appropriately to your data protection rights request
• you have concerns about data security or a possible data breach

This procedure does not cover general complaints about our service or staff behaviour, unless your concern is specifically about how we handled your personal data.

If you want to complain about the service provided by the Housing Ombudsman Service, you must use our service complaints process.

Any expression of dissatisfaction about how we handled your personal data will be treated as a data protection complaint and managed under this procedure.

If your complaint relates to a data protection rights request, we may handle both matters at the same time.

This procedure does not replace our legal duty to respond to your data protection rights requests within the required timescales under UK GDPR.

2.1. When we may not accept your complaint

We will usually accept your data protection complaint. However, there are some situations where we may not be able to investigate your complaint.

We may not accept your complaint if

• it is not about personal data
• you are asking us to re-open a complaint we have already completed
• you have made repeated complaints about the same issue without any new information
• your complaint is about how a member landlord has handled personal data, rather than us
• your complaint is already being investigated by the Information Commissioner’s Office or is part of legal proceedings

If we cannot accept your complaint, we will explain this clearly to you and, where possible, tell you about other options. This may include directing you to the Information Commissioners Office or another relevant process.

We may decide not to continue investigating your complaint at any stage if it becomes clear that we cannot take it forward as a data protection complaint. If this happens, we will explain our reasons to you.

You can submit your complaint in any of the following ways:

• email: inforequests@housing-ombudsman.org.uk
• telephone: 0300 111 3000
• post:
  Housing Ombudsman Service
  PO Box 1484
  Unit D
  Preston
  PR2 0ET

3.1. What information you need to provide

When you make a complaint, you need to give us enough information so we can understand and investigate it properly.

This must include:

• your name and contact details
• clear details about your concern
• any relevant dates, evidence or reference numbers
• how your personal data has been affected, including any impact on you
• what outcome you would like

Providing this information will help us investigate your complaint as quickly and thoroughly as possible. It may also reduce the need for us to contact you again for more details.

3.2. Using an advocate and representative

You can ask someone to make a data protection complaint on your behalf. This could be an advocate or a representative.

If someone acts for you, they must provide evidence that they have your permission to do so.

This may include

• a Data Protection Consent Form signed by you
• a legal document, such as a Power of Attorney or Letter of Authority

We will also need proof of your identity before we can proceed.

Please refer to section 3.3 (Proof of identification) for more information.

3.3. Providing proof of identification

We may ask you to confirm your identity when you make a data protection complaint.

The type of identification we ask for will depend on how sensitive the information is and how much personal data is involved in your complaint.

For example:

• if your complaint involves limited information, we may only ask for minimal identification
• if your complaint involves more sensitive data (such as health, financial or safeguarding information), we may ask for more detailed proof of identity before we proceed

We will only ask for the minimum amount of identification needed to confirm your identity. We will not keep copies of your identification documents.

You can provide one or more of the following:

• a passport
• a photocard driving licence (full or provisional)
• a national identity card
• a birth certificate
• a recent utility bill (dated within the last 3 months)
• a bank or building society statement (dated within the last 3 months)
• a council tax bill for the current year
• official correspondence from a government body (dated within the last 3 months)

You should only send copies of original documents.

We will acknowledge your data protection complaint within 30 calendar days of receiving it.

Our acknowledgement will include

• a unique reference number
• confirmation that we have received your complaint
• a summary of your complaint
• the deadline for our response
• details of how you can complain to the Information Commissioner’s Office

We will send your acknowledgement by email, or in a different format if you have told us about your accessibility needs.

Once you submit a data protection complaint, we will review it to decide how to take it forward.

As part of this review, we will consider

• whether your complaint falls within any of the exclusions in section 2.1
• which team and officer are best placed to investigate and respond
• whether we need more information from you to progress your complaint

5.1. Assessment and triage outcomes

After reviewing your complaint, we will decide one of the following

• Accepted – we will progress your complaint to a Stage 1 investigation
• Not accepted – we will not investigate your complaint under this procedure
• Further information required – we need more information from you before we can continue

If we do not accept your complaint, we will explain our decision clearly and, where possible, tell you about other ways to resolve your issue.

If we need more information, we will contact you directly. We will pause your complaint until you provide the information we need.

Once you send this, we will continue the process.

We will tell you the outcome of our assessment either

• in your acknowledgement email, or
• in a separate communication

At stage 1, we will work to understand your complaint. We will assess whether we have met data protection requirements and our internal policies. We will take appropriate steps to address any issues we identify.

6.1. Stage 1 investigation

At stage 1, we will assign your complaint to an investigating officer with the right expertise. This officer will not have been involved in how your personal data was originally handled or in the issue that led to your complaint.

The investigating officer will focus on the specific concerns you have raised and use these to decide the scope of the investigation.

As part of the investigation, we may

• review relevant records and systems
• speak with employees involved in your case
• consider legal and regulatory requirements
• assess whether we followed our internal procedures
• identify any appropriate and proportionate actions needed to put things right

6.2. Stage 1 outcomes

After completing the investigation, we will use the information we have gathered to decide the outcome of your complaint.

Your complaint will be

• upheld
• partially upheld
• not upheld

If we find that we did not handle your personal data correctly, we will take appropriate and proportionate steps to put things right.

This may include

• giving you an apology and a clear explanation
• correcting your records
• putting right any issues with how we handled your data protection rights request
• providing training or feedback to staff
• making improvements to how we work
• reviewing and updating our procedures

If your complaint suggests there may have been a personal data breach, we will assess this in line with our Data Breach Procedure.

We will also record and review what we learn from complaints like yours, so we can identify patterns and improve our services.

6.3. Stage 1 timescales

We will aim to respond to your complaint within one calendar month of receiving it.

If we need more time, we will let you know before the deadline. We will explain

• the reason for the delay
• what action we are taking
• the new response date
• how you can complain to the Information Commissioner’s Office

Any extra time we take will be proportionate to the complexity of your complaint.

6.4. Stage 1 response

We will send you our stage 1 response in writing, or in a format that meets your accessibility needs.

Our response will include

• the outcome of your complaint (see section 6.2)
• a clear explanation of how we reached our decision
• details of any actions we have taken to put things right
• how you can ask for a stage 2 review
• how you can complain to the Information Commissioner’s Office

Once we send you our stage 1 response, we will close your complaint at this stage.

If you are not satisfied with our stage 1 response, you can ask for a stage 2 review.

You should do this within 4 weeks of the date of our stage 1 response.

If you contact us after this time, we may not be able to accept your review request. However, we may still consider your request based on your individual circumstances.

Stage 2 gives you the opportunity to ask us to review our stage 1 response if you are not satisfied.

At this stage, we will carry out an independent review of your complaint. We will look at all the relevant information again, including

• the evidence available
• the data protection laws that apply
• any specific concerns you have raised about how we handled your complaint or the outcome

7.1. Stage 2 exclusions

We may not accept your request for a stage 2 review if

• you have not completed stage 1
• your request raises new issues that were not part of your original complaint
• you have not provided new information, evidence, or clear reasons for disagreeing with the stage 1 outcome
• your complaint is already subject to legal proceedings or an investigation by the Information Commissioner’s Office

7.2. Stage 2 review process

When you ask for a stage 2 review, we will acknowledge your request within 5 working days. We will tell you whether:

• we have accepted your request
• we have not accepted your request, or
• we need more information from you

If we accept your request, a senior officer will review your complaint. This officer will have the appropriate expertise and will not have been involved in the stage 1 response.

As part of the review, we will consider whether

• we handled your complaint fairly
• the outcome was reasonable
• we applied data protection law and our policies correctly
• any further action is needed

7.3. Stage 2 timescales

We will aim to send you our stage 2 response within one calendar month of receiving your request.

If we need more time, we will follow the same approach set out in section 6.3. This means we will:

• tell you why there is a delay
• explain what action we are taking
• give you a new response date
• provide details of how to contact the ICO

7.4. Stage 2 response

We will send you our stage 2 response in writing, or in a format that meets your accessibility needs.

Our response will include:

• our final decision on your complaint
• a clear explanation of our decision
• details of any further action we have taken
• information about how you can complain to the Information Commissioner’s Office

Once we send you our stage 2 response, we will close your complaint.

If you are still not satisfied, you have the right to escalate your complaint to the ICO. See section 8 below.

If you are not satisfied with how we have handled your complaint, you can contact the Information Commissioner’s Office.

You can do this at any time during or after our complaints process.

You can contact the ICO using the details below:

• Website: Information Commissioner’s Office
• Telephone: 0303 123 1113
• Address:
  Information Commissioner’s Office
  Wycliffe House
  Water Lane
  Wilmslow
  Cheshire
  SK9 5AF

We will keep a record of your complaint and how we responded.

We will normally retain this information for 3 years from the date your complaint is closed, unless we need to keep it for legal reasons.

We will handle your complaint confidentially wherever possible. Only authorised staff will have access to your information.

When we process your personal data as part of your complaint, we will do this in line with the Data Protection Act 2018 and UK GDPR.

You can find more information about your data rights and how we use your personal data in our Privacy Notice.