Data Protection Complaints Procedure

Data Protection Complaints Procedure

Required under the Data (Use and Access) Act 2025 | In force from 19 June 2026

Purpose

This procedure sets out how SIRPA handles complaints from individuals about the way we process their personal data. It meets the legal requirement introduced by the Data (Use and Access) Act 2025, which requires all organisations to have a complaints process in place from 19 June 2026.

We are committed to handling complaints fairly, consistently, and transparently.

Scope

This procedure applies to all data protection complaints received from:

Customers and clients
Website visitors
Employees, former employees, and job applicants
Suppliers and contractors
Any other individual whose personal data we process

A data protection complaint is any expression of dissatisfaction about how SIRPA handles personal data. A data protection complaint may relate to any aspect of how we collect, store, use, share, or delete personal data, including but not limited to:

A refusal to provide information in response to a subject access request (SAR)
Concern about how we use personal data for marketing
Belief that their data has been lost, stolen, or shared without authorisation
Objection to how long we retain their data
Any other alleged breach of UK GDPR or the Data Protection Act 2018

Who Is Responsible

The following person is appointed as our Data Protection Complaints Owner:

Complaints Owner

Georgina Oldfield MCSP

Job title

Physiotherapist & Founder of SIRPA Ltd.

Email address

admin@sirpa.org

Phone

01484 452500

If this person is unavailable, complaints will be handled by: Cath Thompson / Admin and Tech Assistant.

All complaints are handled confidentially and only shared with staff who need to know in order to investigate.

How to Make a Complaint

We make it easy for individuals to raise a data protection complaint. Any of the following methods are accepted:

Email: admin@sirpa.org
Post: SIRPA Ltd, 19 Longley Lane, Huddersfield, HD4 6PS
Telephone: 01484 452500

Complaints do not need to be in a specific format. We will accept them verbally or in writing. Where a complaint is made verbally, we will make a written record of it. We will make reasonable adjustments to support individuals who need help making a complaint.

The Complaints Process

The table below sets out each stage of our process, who is responsible, and the expected timeframe.

Stage	Action	Who	Timeframe
1. Receipt	Receive complaint (email, letter, in person)	Georgina Oldfield MCSP, Physiotherapist & Founder of SIRPA Ltd. Or Cath Thompson, Admin and Tech Assistant.	Day 0
2. Acknowledgement	Send written acknowledgement to complainant	Georgina Oldfield MCSP, Physiotherapist & Founder of SIRPA Ltd. Or Cath Thompson, Admin and Tech Assistant.	Within 5 working days (30 days legal maximum)
3. Log	Record in Complaints Log with reference number	Georgina Oldfield MCSP, Physiotherapist & Founder of SIRPA Ltd. Or Cath Thompson, Admin and Tech Assistant.	Within 2 working days
4. Investigation	Review the complaint; gather relevant records	Georgina Oldfield MCSP, Physiotherapist & Founder of SIRPA Ltd. Or Cath Thompson, Admin and Tech Assistant.	Within 30 days of acknowledgement
5. Update	Keep complainant informed of progress	Georgina Oldfield MCSP, Physiotherapist & Founder of SIRPA Ltd. Or Cath Thompson, Admin and Tech Assistant.	As needed
6. Decision	Reach outcome; prepare written response	Georgina Oldfield MCSP, Physiotherapist & Founder of SIRPA Ltd. Or Cath Thompson, Admin and Tech Assistant.	Without undue delay
7. Response	Inform complainant of outcome and next steps	Georgina Oldfield MCSP, Physiotherapist & Founder of SIRPA Ltd. Or Cath Thompson, Admin and Tech Assistant.	Without undue delay
8. Escalation	If unresolved, signpost ICO (ico.org.uk/concerns)	Georgina Oldfield MCSP, Physiotherapist & Founder of SIRPA Ltd. Or Cath Thompson, Admin and Tech Assistant.	At closure
9. Closure	Close complaint; update log with outcome	Georgina Oldfield MCSP, Physiotherapist & Founder of SIRPA Ltd. Or Cath Thompson, Admin and Tech Assistant.	After response sent

Timescales

The following timescales apply:

Acknowledgement:

We aim to acknowledge all complaints within 5 working days. The legal maximum is 30 days from receipt.

Investigation and response:

We will investigate and respond without undue delay. In most straightforward cases this will be within 30 days of acknowledgement. For complex cases we may take longer; if so, we will inform the complainant and explain the reason for the delay.

Stop the clock:

Stop the clock means the investigation timeframe is paused while we wait for information requested from the complainant. If we need further information from the complainant to investigate their complaint, the timeframe may be paused until the requested information is received.

Acknowledgement

We aim to acknowledge all complaints within 5 working days, even though the legal maximum is 30 days of receiving a complaint, we will send the complainant a written acknowledgement that includes:

Confirmation that we have received their complaint
The reference number assigned to their complaint
The name and contact details of the person handling it
An outline of the next steps and expected timeframe

Investigation

The complaints owner will investigate the complaint by:

Reviewing the complaint in full
Gathering relevant records, documents, or data
Consulting colleagues or systems involved where appropriate
Assessing whether a breach of data protection law has occurred
Identifying any remedial action required

We will keep the complainant informed of progress throughout the investigation, particularly if there are any delays.

Outcome and Response

On completing our investigation, we will send the complainant a written response that includes:

A clear statement of our findings
Whether we uphold, partially uphold, or reject the complaint, and why
Any action we have taken or will take as a result
Information about their right to escalate to the ICO if they remain dissatisfied

If we uphold the complaint, we will take prompt corrective action — for example, correcting inaccurate data, deleting data, or updating our practices.

Escalation to the ICO

If a complainant remains unhappy with our response, or if we fail to respond within a reasonable time, they have the right to complain to the Information Commissioner’s Office (ICO):

ICO website

ico.org.uk/concerns

ICO helpline

0303 123 1113

We will always include ICO escalation information in our final response letter.

Record Keeping

We maintain a Complaints Log to record all data protection complaints received. The log is kept confidentially and reviewed by the complaints owner. It records:

A unique reference number
The date the complaint was received
The name of the complainant
A brief description of the complaint
The date of acknowledgement
The outcome and date of closure

Records are retained for 3 years after the complaint is closed, in line with our Data Retention Policy.

Learning and Improvement

We treat complaints as an opportunity to improve. The complaints owner will:

Review complaints periodically (at least annually) to identify any patterns or recurring issues
Report significant complaints to senior management
Update our data protection practices where complaints reveal gaps or weaknesses
Review this procedure at least annually, or following any significant change in the law or our business

Privacy Notice
Data Protection Policy
Subject Access Request Procedure
Data Retention Policy
Data Breach Response Procedure

A summary of this procedure is published in our Privacy Notice.

Last reviewed: June 2026 | SIRPA Ltd