Data protection complaints procedure

Last updated 16 June 2026.

Purpose

This procedure sets out how Wilkin Chapman Rollits receives, acknowledges, investigates and resolves complaints from individuals about the way the firm processes their personal data. It ensures compliance with the mandatory complaints handling requirements introduced by section 103 of the Data (Use and Access) Act 2025, which inserts a new section 164A into the Data Protection Act 2018.

This procedure applies to all data protection complaints received by the firm, whether made by clients, employees, third parties or their authorised representatives. 

A data protection complaint is any expression of dissatisfaction from an individual who considers that our firm has infringed data protection legislation in the way we have handled personal information. 

We aim to:

• Process personal data lawfully, fairly and transparently

• Collect personal data only for specified and legitimate purposes

• Ensure personal data is adequate, relevant and limited to what is necessary

• Keep personal data accurate and up to date

• Retain personal data only for as long as necessary

• Protect personal data using appropriate technical and organisational security measures

• Handle complaints consistently, fairly and without undue delay

We recognise that concerns may arise regarding how personal data is handled. This procedure ensures complaints are managed effectively and that appropriate action is taken where required.

Scope

This procedure applies to any individual whose personal data we process, including clients, employees, suppliers, contractors and other third parties.

A data protection complaint includes any concern relating to:

• The collection, use, sharing, retention or deletion of personal data

• The accuracy of personal data

• Subject access requests or other individual rights requests

• Data breaches or information security concerns

• Direct marketing communications

• Automated decision-making or profiling

• International transfers of personal data

Where a complaint also relates to service quality or professional conduct, separate complaints procedures may also apply.

Contact details

Data protection complaints should be directed to the Risk & Compliance Department using the dedicated email address for data protection complaint’s below:

Email: [email protected]

Post:

Risk & Compliance Department

Wilkin Chapman Rollits

Cartergate House

26 Chantry Lane

Grimsby

DN31 2LJ

Complaints may also be made through the firm's main switchboard.

The firm’s Data Protection Officer (DPO) is responsible for overseeing compliance with this procedure. There contact email address is: [email protected]

How to make a complaint

Complaints may be submitted in writing, by email, by telephone, by electronic form found on our website or in person.

Please provide as much information as possible, including:

• Your name and contact details

• Details of your complaint

• Relevant dates or correspondence

• Any supporting documentation

Authorised representatives may make complaints on behalf of another individual. We may request evidence of authority before disclosing personal data.

Complaints handling process

Receipt and acknowledgement

All complaints are reviewed promptly upon receipt.

We will acknowledge complaints without undue delay and aim to respond within 30 calendar days.

Acknowledgements will normally:

• Confirm receipt of the complaint

• Provide a reference number where applicable

• Explain the next steps

• Provide anticipated response timescales

• Inform you of your right to contact the Information Commissioner’s Office (ICO)

Where necessary, we may request additional information to clarify the complaint or verify identity.

Investigation

Complaints will be investigated fairly, independently and proportionately.

Investigations may include:

• Reviewing relevant records and correspondence

• Examining the personal data and processing activities involved

• Speaking with relevant staff members

• Reviewing applicable policies and procedures

• Assessing whether a personal data breach has occurred

We may contact you for further information during the investigation.

Our target timeframe for providing a final response is 45 days, extending to 60 days depending on the complexity of the complaint.

Complaint outcomes

Our written response will set out:

• The findings of the investigation

• Whether the complaint has been upheld, partially upheld or not upheld

• Any actions taken or proposed

• Information regarding escalation rights

Where appropriate, we may:

• Correct inaccurate information

• Restrict or cease certain processing activities

• Improve procedures or staff training

• Implement additional security measures

Complaints involving data processors

Data Controllers are responsible for dealing with personal data complaints.  There are occasions where we are a Data Processor, rather than a Data Controller.  In those circumstances we will forward the complaint to the correct firm to action and notify you promptly that the complaint has been redirected. 

Escalation to the ICO

If you are dissatisfied with the outcome of your complaint, you may contact the Information Commission (ICO).

ICO Head Office

4th Floor, No.3 Circle Square

5 Hawkshaw Street

Manchester

M1 7BL

Tel: 0303 123 1113

Website: https://ico.org.uk/make-a-complaint/

Complaints involving third parties

In most circumstances we are a Data Controller and will respond to your complaint.  If the complaint relates to a third-party processor acting on our behalf, we will notify you that we are a Data Processor in those circumstances and let you know that the Data Controller will be responsible for that complaint and we have forwarded to them to action.

Complaints involving children or vulnerable individuals

Complaints involving children or vulnerable individuals will be handled with additional care and sensitivity.

Communications will be provided in clear and accessible language where appropriate.

Record keeping

We maintain records of data protection complaints, investigation outcomes and any remedial actions taken.

Records are retained securely and in accordance with our retention policies and applicable legal requirements.

Monitoring and improvement

We monitor the outcomes to enhance our data protection practices and support ongoing compliance.