How to handle a GDPR complaint, step by step

The eight steps

1. Recognise it as a complaint. A person does not need to use legal language. Treat a concern about your handling of personal data as a complaint. It may arrive by email, a web form, social media, telephone or through any member of staff. Do not require the person to submit it again through a preferred channel.
2. Log it the same day. Record the date and channel of receipt, the person's contact details, a neutral summary and who will handle it. Keep the original message. This first entry starts a single history that should remain current until the outcome is given.
3. Acknowledge in writing. Acknowledge receipt within 30 days. An automated electronic acknowledgement is sufficient when the complaint was submitted by email. Record how and when acknowledgement happened. Make clear that you have received the complaint without suggesting that an outcome has already been reached.
4. Work out what is being asked. Break the message into clear questions or concerns. A complaint may also contain a subject access request, which asks for access to personal data. Record the two parts separately so that each can be handled under the correct duty. The complaint and subject access request comparison helps staff recognise both.
5. Investigate. Without undue delay, take appropriate steps to respond. This includes making appropriate enquiries. Identify relevant people and records. Note each enquiry, what it established and what remains unclear. Keep the complainant informed while the work continues.
6. Decide the outcome. Compare the concern with what your enquiries established. Decide an outcome that addresses each material point. Keep the reasoning factual. Do not add assumptions to fill gaps in the record.
7. Write to the person. Tell the person the outcome without undue delay. Explain the concern you considered, the enquiries made, what you found and the result. Use plain language. Record the date and method used to send it.
8. Close the file and learn from it. Check that the record contains receipt, acknowledgement, investigation steps and outcome. The ICO can ask to see these records. Close the operational work only after the outcome has been given and the record is complete.

What to do in the first hour

Preserve the complaint and enter it in your data protection complaint log. Confirm who owns the next action. If it reached somebody who does not handle complaints, make the internal handover visible rather than relying on a forwarded message with no owner.

Read for the substance, not the label. Someone may say they are unhappy, ask why data was used, or object to an action without calling the message a complaint. Note the concerns in simple language. If the message also asks for personal data, mark that separately rather than forcing the whole message into one category.

Send or arrange the acknowledgement. Although the legal requirement is within 30 days, an early acknowledgement confirms that the route works. For email, an automated electronic response can be sufficient. Automation does not remove the need to put the complaint into the log and assign it to a person.

What to do in the first week

Plan the enquiries. Decide which records and colleagues can answer the concern. Ask focused questions and record the response. Keep the complainant informed without undue delay. An update should say what stage the work has reached without promising a conclusion before the enquiries are complete.

Check whether the person has enough information about the process. Privacy notices must tell people about their right to complain and provide the ICO's contact details. People must also receive that information when a controller responds to a subject access request. Make sure staff use current wording and contact details.

Keep all channels connected to the same record. A social media message, an email attachment and notes from a conversation may all belong to one complaint. Avoid creating duplicate histories. If new concerns are raised, add them clearly so the outcome can deal with them.

What to do in the first month

Check that acknowledgement has happened within 30 days and that the evidence is in the record. Continue enquiries without undue delay. The 30 day acknowledgement duty is not a general deadline for finishing every complaint. The other duties require appropriate steps, updates and an outcome without undue delay.

Draft the outcome around the person's actual concerns. Keep it short enough to follow but complete enough to show what was considered. The free outcome letter wording provides a structure. Record the final version and when it was sent.

Common mistakes

Common failures are practical. A message stays in one inbox. Staff insist on a form. An autoresponder is treated as the whole record. Enquiries happen but are not noted. The person hears nothing while work continues. The final reply does not answer the concern. A clear owner and one current record prevent these gaps.

Do not assume a small organisation is outside the duty. Section 164A applies to all controllers regardless of size, sector or processing activity. A proportionate process can still be simple, but it must cover every required stage.

Worked example

A customer sends a social media message to a staff member saying their personal data was handled wrongly. The staff member records the message and routes it to the complaints owner. The owner logs the receipt date, acknowledges it within 30 days, identifies the concern and makes appropriate enquiries with the relevant colleagues.

The owner records each enquiry and sends updates without undue delay. Once the facts are clear, the organisation explains what it found and gives the outcome without undue delay. The final record contains the original message, acknowledgement details, enquiry notes, updates and outcome. This is the same core process described in the complaint handling process guide.