Complaint or subject access request?

Two different rights

A data protection complaint expresses concern about how an organisation has handled personal data. A subject access request asks the organisation to provide access to the person's personal data. Subject access request is often shortened to SAR or DSAR. The two can appear in the same sentence, but they are not the same task.

Look at what the person wants. If they want the organisation to examine something that went wrong and give an outcome, that is a complaint. If they want access to personal data, that is a subject access request. If they want both, record both.

Do not require legal labels. A person may write, "I want to know what information you used and why you shared it." The request for information may include subject access, while the concern about sharing may be a complaint. Staff should recognise the substance and route each part correctly.

A complaint can be submitted through any channel, including social media, and can be made to any member of staff. It should enter the step by step complaint process without being rejected because it reached an unexpected place.

The two clocks

Section 164A creates a clear complaint acknowledgement period. Receipt must be acknowledged within 30 days. The controller must then take appropriate steps to respond, including making appropriate enquiries, keep the person informed and tell them the outcome, all without undue delay.

The supplied legal facts for this page do not state the response deadline for a subject access request. [VERIFY: insert the current statutory subject access response deadline before publication.] Do not copy the complaint acknowledgement period into the subject access process. Keep the two clocks distinct.

Acknowledgement and outcome are also different points. The 30 day complaint requirement concerns acknowledgement of receipt. It is not a general deadline for every investigation or a replacement for the duties that apply without undue delay.

Record the receipt date for each workstream. If one message contains both, the same message can be preserved in both records, but each record should show its own owner, required actions and progress. The complaint log guide explains the complaint side of that evidence.

When you receive both

Start by separating the message into plain questions. Mark the part that asks for personal data. Mark the part that raises concern about how personal data was handled. Do not wait for the person to rewrite their message.

Acknowledge the complaint within 30 days. Apply your verified subject access process to the request for data. Tell the person that you have identified both parts and will deal with each. Keep the wording simple so they can see that neither point has been overlooked.

The controller must tell people about their right to complain when responding to a subject access request. It must give the ICO's contact details. This requirement applies even when the original subject access request did not also contain a complaint.

Assign ownership. One person may coordinate both workstreams, or different people may handle them. Either arrangement can be clear if the records show responsibility and progress. Avoid a handover in which each person assumes the other is dealing with the whole message.

Keep the outputs distinct enough to understand. The subject access response deals with access to personal data. The complaint outcome deals with the concern, the appropriate enquiries and what was decided. They may be sent together if that is workable, but each duty still needs its own complete answer.

Side by side comparison

Why confusion causes problems

If a complaint is treated only as a subject access request, the organisation may provide data without examining the concern or giving an outcome. If a subject access request is treated only as a complaint, the person may receive an explanation without the access they asked for.

One inaccurate label can also hide the true complaint volume. The ICO has said it will use complaint volumes and trends to identify potential compliance issues and decide whether to intervene with individual organisations. Record complaints consistently even when they arrive inside another request.

Give staff one intake question: does the message ask for access, raise a concern, or do both? Then use the data protection complaint handling process for the complaint and your verified subject access process for the request.