Making a complaint: what happens next?

Before you make a formal complaint against someone who you think is misusing personal data, you may find it useful to understand how this process works, and the timescales involved.

Below is a step by step guide summarising what to expect once your complaint has been made.

1. You will receive acknowledgement of your complaint along with a unique case reference within two weeks.
2. We will then assess your complaint and notify you of whether your complaint will be investigated or not within two months of the complaint being made.
3. Should we decide not to investigate your complaint, we will let you know why. This will include your right to appeal that decision.
4. Following this, you will be updated on the status of the investigation every three months.
5. When we finish our investigation, we will let you know whether we have identified any breaches and the outcomes. If we have been unable to find any breaches, we will let you know about your right to appeal our findings.
6. We may wish to make a public statement at the conclusion of an investigation. Public statements commonly include details of the organisation who has been found in breach as well as details of the outcome. We will always endeavour not to include identifying information about complainants. If there is a chance that you can be identified in our public statement, we will consult you before publishing. You will have an opportunity to discuss any concerns with us at that time.

Should you need to provide any additional information on receipt of your acknowledgment, please email casework@odpa.gg