How to Complain to the ICO
Step-by-step guide to data protection and information rights complaints
Your right to complain to the ICO is set out in UK data protection law and the Freedom of Information Act. The ICO is the UK's independent regulator for information rights.
Important: New Rules from the Data (Use and Access) Act 2025
From June 2026, organisations have new legal duties when handling data protection complaints:
- Must provide a way for you to make a complaint (e.g., complaint form)
- Must acknowledge your complaint within 30 days
- Must investigate and keep you informed of progress
- Must tell you the outcome without undue delay
When Can You Complain to the ICO?
Step-by-Step Process
Complain to the Organisation First
The ICO expects you to give the organisation a chance to resolve your complaint first. Use our template below to contact them.
Complain to the ICO
If you're unhappy with the response, or don't receive one, you can complain to the ICO.
Contact the ICO:
Helpline: 0303 123 1113
Online: ico.org.uk/make-a-complaint
What the ICO Will Do
The ICO will review your complaint and decide how to proceed. They may contact you for more information or investigate the organisation directly.
If You're Unhappy with the ICO's Response
If the ICO does not resolve your complaint, you may be able to appeal to the First-tier Tribunal (Information Rights). This is a legal process, and you should consider seeking independent advice.
What the ICO Can Do
Information Notices
Require organisations to provide information to assist an investigation.
Assessment Notices
Allow the ICO to audit an organisation's compliance.
Enforcement Notices
Require organisations to take specific action to comply with the law.
Template Letters
1. Complaint to the Organisation
Based on ICO template letters
[Name and address of the organisation] [Reference number (if provided)] Dear [Sir or Madam], Data Protection Complaint [Your full name and address] I am concerned that you have not handled personal information properly. [Give details of your complaint, explaining clearly and simply what has happened and, where appropriate, the effect it has had on you.] I understand that before reporting my complaint to the Information Commissioner's Office (ICO) I should give you the chance to deal with it. If, when I receive your response, I would still like to report my complaint to the ICO, I will give them a copy of it to consider. Please send a full response within 30 days. If you cannot respond within that timescale, please tell me when you will be able to respond. Yours faithfully, [Your signature] [Your printed name]
2. Complaint to the ICO
Information Commissioner's Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF Date: [Date] Subject: Complaint regarding [Organisation Name] Dear Sir/Madam, I am writing to make a formal complaint about [Organisation Name]. Background: [Explain what happened - when you made your request, what was requested, etc.] Organisation's response: [Summarise the organisation's response, or state that no response was received within the statutory timeframe. Attach copies of correspondence.] Why I am complaining: [Explain why you are dissatisfied - e.g., they failed to respond, refused without valid explanation, provided incomplete information, etc.] Steps taken: I first raised my concerns directly with the organisation on [date]. A copy of my complaint and their response (if any) are attached. I would be grateful if the ICO would investigate this matter. Yours faithfully, [Your name] [Your address] [Your email] Enclosures: [List any attachments]
Contact the ICO
Helpline
0303 123 1113
Online
ico.org.uk/make-a-complaintPost
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline open Monday to Friday, 9am to 5pm (excluding bank holidays)
Sources and further reading:
- Information Commissioner's Office – Make a complaint (ico.org.uk/make-a-complaint)
- UK GDPR and Data Protection Act 2018
- Freedom of Information Act 2000
- Data (Use and Access) Act 2025
- ICO Regulatory Action Policy
This guide is based on publicly available information from the ICO and UK legislation. Laws and guidance may change over time.