What to do if an organisation fails to respond to your data request
–– 26 Jun 2019
Is an organisation not responding to your subject access request? Are they being difficult with a data request? You are entitled under GDPR to receive an answer without undue delay and at the latest within a month.
This guide will show you the next steps you can take and how to make a data complaint to the regulator…
Make a complaint to The Information Commissioners Office (ICO)
You need to return it by post or email with copies of your original request and any correspondence. Ensure you include all your interactions with the organisation as this will provide evidence of your data request complaint.
Our free data rights app available on Apple and Android is an easy way to send data requests, whilst keeping a central record of all your interactions with organisations. Keeping this evidence in one place will make your life easier when making a complaint to the regulator. Plus we don’t capture any of your personal data or communication ourselves.
Emailing your complaint
If all your supporting evidence is available electronically, you can send the form by email.
- Save the Word version of the complaints form to your computer.
- Fill the form in and save it again.
- Open a new email, with ‘Report a concern’ in the subject line.
- Attach this form and any other documents you wish to send to the ICO. Please ensure your combined email attachments do not exceed 10 MB in a single email. You may send attachments over multiple emails, but please indicate this in the subject line.
- Send to firstname.lastname@example.org
Please note: email may not be secure.
Posting your complaint
If your supporting evidence is in hard copy, you can print out the complaints form and post it (with your supporting evidence) to:
Information Commissioner’s Office
The ICO usually takes around two weeks just to allocate a case officer and, depending on the complexity of a complaint, can take several months to reach a decision.