A GDPR complaint form for your website

What a compliant form needs

A form gives people a clear route for sending a data protection complaint. It can help you collect useful information in a consistent format. It is not compulsory. The ICO has said a separate form or complaints tool is not required and that existing contact methods can be adapted.

Do not make the form the only route. Complaints must be accepted however submitted, including through social media, and can be made to any member of staff. If someone complains by email or telephone, handle that complaint rather than directing them back to the website.

Ask for the person's name, a reliable contact method, what happened and any relevant dates. Give them space to explain the concern in their own words. Supporting material can be optional. Keep compulsory fields to those needed to receive and respond to the complaint.

The form should feed the same data protection complaint log as every other channel. Record when it arrived, how and when it was acknowledged, investigation steps and the outcome. The ICO can ask to see those records.

Copy and paste HTML

This plain HTML provides labelled fields and an explanation that other complaint routes remain available. Replace the action address, organisation name, contact route and privacy notice link before publishing it.

<form action="[YOUR FORM HANDLER]" method="post">
  <h2>Make a data protection complaint</h2>
  <p>You can also complain by [OTHER CONTACT ROUTE].</p>

  <label for="full-name">Your name</label>
  <input id="full-name" name="full-name" autocomplete="name" required>

  <label for="email">Email address</label>
  <input id="email" name="email" type="email" autocomplete="email" required>

  <label for="reference">Account or reference number (optional)</label>
  <input id="reference" name="reference">

  <label for="dates">Relevant date or dates (optional)</label>
  <input id="dates" name="dates">

  <label for="complaint">Tell us what happened</label>
  <textarea id="complaint" name="complaint" rows="8" required></textarea>

  <label for="outcome">What would you like us to consider? (optional)</label>
  <textarea id="outcome" name="outcome" rows="4"></textarea>

  <p>Read how [ORGANISATION NAME] uses your information in our
    <a href="[PRIVACY NOTICE URL]">privacy notice</a>.
  </p>

  <button type="submit">Send complaint</button>
</form>

The form handler is the service that receives a submission. Make sure it sends the information to the correct place, records the receipt date and starts your acknowledgement process. Test it before publication and whenever the receiving address or service changes.

Accessibility notes

Every field in the example has a visible label connected to the input. Do not replace those labels with placeholder text inside fields. Keep instructions close to the field they describe and make error messages specific. A person should be told which field needs attention and what to do next.

Use clear language. Avoid asking people to select a legal category before they can submit. They may know what happened but not which rule applies. Let them describe the concern, then classify it within your process.

Do not require supporting documents. A person may not have them, and the complaint still needs to be accepted. If you add an upload control, explain accepted file types and limits. [VERIFY: confirm the file controls and security checks used by your form service.]

After submission, show a clear confirmation and send an acknowledgement through the contact method provided. Section 164A requires acknowledgement within 30 days. The ICO has said an automated electronic acknowledgement is sufficient when a complaint is submitted by email.

Where to publish it

Link the form from the part of your website where people look for privacy information. Your privacy notices must tell people about their right to complain and give the ICO's contact details. They should also make your own complaint route easy to find.

People must be told about their right to complain when you respond to a subject access request, and they must receive the ICO's contact details. A subject access request asks for access to personal data. Keep that response wording aligned with your published routes.

Tell staff where form submissions arrive and who owns them. Include the form in your end-to-end complaint handling process, but do not treat it as the whole process. Receipt is followed by acknowledgement, appropriate enquiries, updates, outcome and records.

Before the form goes live

• Replace every bracketed item in the example.
• Submit a test complaint and confirm it reaches the correct owner.
• Check that the receipt date enters your complaint log.
• Check acknowledgement wording and delivery.
• Confirm staff will accept complaints through other channels.
• Link to the privacy notice and provide the ICO's contact details where required.

The free complaint templates include acknowledgement wording that can sit behind this form. Adapt it to describe what your organisation will actually do.