Complaining to the Information Commissioner about a Data Breach

The ICO is the UK's independent regulator for data protection. Its main powers:

• Investigate complaints about how organisations handle personal data.
• Issue Information Notices requiring organisations to provide evidence.
• Issue Enforcement Notices requiring organisations to change practices.
• Issue Monetary Penalty Notices — fines up to £17.5 million or 4% of global turnover under UK GDPR (Art 83); £500,000 maximum under PECR.
• Prosecute some criminal offences — unauthorised obtaining or disclosure of personal data (section 170 DPA 2018), forced SARs (section 184), and obstruction.
• Audit public sector organisations and major data controllers.

What the ICO CANNOT do:

• Order the organisation to pay you compensation. You must claim that separately in court.
• Reverse the organisation's decision (e.g. compel them to give you a job after a SAR reveals discrimination — that is a different jurisdiction).
• Investigate complaints that are about data that is not personal data (mostly trade or legal disputes).
• Force organisations to keep specific data — they regulate processing, not retention strategy.

Most ICO complaints fall into one of these categories:

• Failed Subject Access Request — you asked for your personal data and the organisation did not respond, responded late (more than 1 month), or refused unreasonably.
• Data breach affecting you — your data was lost, stolen, or disclosed to someone who should not have had it.
• Inaccurate data — incorrect information held about you, and the organisation refuses to correct it.
• Unauthorised marketing — texts, calls, or emails after you opted out, or that you never consented to (PECR territory).
• Excessive data collection — an organisation collecting more than necessary.
• Refusal of erasure request — you asked for your data to be deleted ("right to be forgotten") and were refused.
• FOI delays or refusals — public body did not provide information you requested under the Freedom of Information Act 2000.

The ICO expects you to complain to the organisation first. This is sensible for two reasons:

1. Most issues are resolved more quickly directly. Organisations are usually motivated to fix issues that could become ICO complaints.
2. The ICO will often refuse to investigate cases where the organisation has not had a chance to respond.

How to complain to the organisation:

• Find the Data Protection Officer (DPO) — usually listed on the organisation's privacy notice.
• Submit a written complaint setting out the specific data protection issue and what you want done.
• Allow at least 1 month for a substantive response.
• If unsatisfied, request escalation through any internal review process.
• Get a "final response" or "deadlock" letter — this is the trigger for ICO escalation.

Submit at ico.org.uk/make-a-complaint. Include:

• The organisation's name and address.
• Your data protection issue, in concrete terms.
• What you asked the organisation to do.
• Their response (if any).
• Copies of supporting evidence — emails, letters, screenshots, the original SAR.
• What you want the ICO to do (investigate, warn the organisation, change practices).

Process:

1. Acknowledgement within days.
2. Case officer assigned within 1-3 months.
3. Investigation — the case officer writes to the organisation, requests evidence, drafts an opinion.
4. Outcome — usually a letter explaining what the ICO found and what they have asked the organisation to do.
5. If serious, the case may be escalated to enforcement action (fines, regulatory orders).

Most complaints are resolved within 6 months. Complex investigations (especially involving large data sets or sectors) can take 12-18 months.

The ICO does not award you compensation. To get compensation:

• Claim in the County Court under Article 82 UK GDPR — material damage (financial loss) and non-material damage (distress, anxiety).
• Time limit: 6 years from the breach (Limitation Act 1980 s.5).
• The ICO's decision (if it upheld your complaint) is strong supporting evidence for the court claim, though not binding.
• Awards: small money claims for distress typically £100-£2,000; serious cases (identity theft, ongoing harassment from leaked data) £5,000-£25,000+; severe cases (e.g. NHS data leaks causing harm) can exceed £100,000.

The Supreme Court in Lloyd v Google [2021] UKSC 50 confirmed that compensation for distress alone is available, but on an individual basis — there is no representative or class action route under DPA 2018. Each affected person must claim individually unless joined under a Group Litigation Order.