How to handle a GDPR complaint, step by step
In short
Placeholder 40 word summary answering how to handle a complaint about personal data: log it, acknowledge it in writing within 30 days, investigate without undue delay, then tell the person the outcome.
The eight steps
- Recognise it as a complaint. Placeholder copy.
- Log it the same day. Placeholder copy.
- Acknowledge in writing. Placeholder copy.
- Work out what is being asked. Placeholder copy.
- Investigate. Placeholder copy.
- Decide the outcome. Placeholder copy.
- Write to the person. Placeholder copy.
- Close the file and learn from it. Placeholder copy.
Common mistakes
Placeholder copy.
Worked example
Placeholder copy.
Related guides
- Build your complaint handling process
The written procedure these steps sit inside.
- Complaint or subject access request?
Two duties, two different deadlines.
- Free acknowledgement and outcome templates
Copy the wording for each step.
Common questions
- What counts as a data protection complaint?
- Placeholder answer.
- When does the 30 day clock start?
- Placeholder answer.
- Can we reject a complaint?
- Placeholder answer.
- What do we say in the outcome?
- Placeholder answer.
- What if the person is still unhappy?
- Placeholder answer.
This is general information, not legal advice.