Make a data protection complaint

This procedure explains how individuals can raise concerns about the way we collect, use, store, share, or otherwise process their personal data and how those complaints will be handled.

We are committed to complying with the UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025 (DUAA). We will investigate all data protection complaints fairly, promptly, and transparently.

This procedure applies to complaints relating to personal data, including but not limited to:

• Collection or use of personal information.
• Accuracy of personal information held.
• Disclosure of personal information to third parties.
• Data retention practices.
• Direct marketing communications.
• Data subject rights requests.
• Security or confidentiality of personal information.
• Any alleged breach of UK data protection legislation.

Complaints may be submitted by emailing the Data Protection Complaint Form to informationgovernance@exeter.ac.uk.

A complaint does not need to reference specific legislation or use legal terminology. Any concern regarding the handling of personal data will be treated as a potential data protection complaint and assessed accordingly. 

Upon receiving a complaint, we will:

1. Record the complaint in our Complaint Register.
2. Assess whether it is a data protection complaint.
3. Acknowledge receipt within 30 calendar days.

The acknowledgement will include:

• Confirmation that the complaint has been received.
• A summary of the complaint.
• Contact details of the person handling the matter.
• Information about the investigation process.

The complaint handler will:

• Review the issues raised.
• Gather relevant information and evidence.
• Consult relevant departments or personnel where necessary.
• Assess compliance with applicable data protection laws.
• Identify any remedial action required.

The investigation will be conducted objectively and confidentially.

We will keep the complainant informed of progress where appropriate and provide updates if the investigation is likely to take longer than anticipated. 

Following the investigation, we will provide a written outcome without undue delay.

The outcome may include:

• Confirmation that the complaint has been upheld.
• Confirmation that the complaint has not been upheld.
• An explanation of the findings.
• Details of any corrective actions taken.
• Any lessons learned or process improvements identified.

Possible actions may include:

• Correcting inaccurate records.
• Restricting or stopping processing.
• Providing additional staff training.
• Reviewing policies and procedures.
• Taking disciplinary action where appropriate.

If the complainant remains dissatisfied after receiving our final response, they may escalate their concerns to the Information Commissioner's Office (ICO).

ICO contact details:

Website: https://ico.org.uk
Telephone: 0303 123 1113

We will maintain records of:

• Complaints received.
• Correspondence and evidence reviewed.
• Investigation findings.
• Outcomes and actions taken.

Records will be retained in accordance with our retention schedule and data protection requirements.

Employees

All employees must:

• Recognise potential data protection complaints.
• Forward complaints promptly to the Information Governance Team
• Cooperate with investigations.

Data Protection Officer 

The designated officer is responsible for:

• Managing investigations.
• Ensuring compliance with statutory requirements.
• Maintaining complaint records.
• Reporting trends and issues to senior management.