How to Make an ICO Complaint About How Your Data Is Used

To make an ICO complaint, first raise your concern directly with the organization and give it a chance to respond. If it doesn’t reply, or you’re unhappy with the answer, submit a complaint to the UK Information Commissioner’s Office through the complaint forms on its official website, ico.org.uk, with copies of your correspondence. The ICO generally asks that you come to it within three months of your last meaningful contact with the organization.

The ICO is the UK’s independent regulator for data protection. It can look at how an organization handled your data and tell it to put things right, but it isn’t a court and it doesn’t award compensation. This guide covers how to prepare, what to send and what to expect. It’s general information, not legal advice. If your complaint is about an organization in the EU, see our guide on how to make a GDPR complaint instead.

What the ICO is and what it covers

The Information Commissioner’s Office oversees several laws. The main ones for individuals are:

• The UK GDPR and the Data Protection Act 2018. How organizations collect, use, share, store and delete personal data, and your rights to access, correction and erasure.
• The Privacy and Electronic Communications Regulations (PECR). Marketing calls, texts and emails, and cookies.
• Freedom of information law. Requests for information held by public authorities, such as councils and government departments.

The Data (Use and Access) Act 2025 amends parts of UK data protection law, including a new requirement for organizations to have a process for handling data protection complaints. Its provisions are being brought into force in stages, so check the ICO’s guidance for what applies when you complain.

What you can complain about

Common reasons people complain to the ICO include:

• An ignored or incomplete subject access request. Organizations usually have one month to respond. If you haven’t made one yet, our guide to making a data subject access request covers the wording.
• A refused erasure request. Including an organization keeping data it no longer needs. Our guide to the GDPR right to erasure explains when that right applies.
• A search engine refusing to delist a result about you. If a search engine turns down a “right to be forgotten” request, you can ask the ICO to look at it.
• Your data being shared without a lawful basis. For example, an employer passing on personal details it shouldn’t have.
• Inaccurate data used against you. Wrong information on a record that affects decisions about you.
• A data breach that was poorly handled. Where you weren’t told, or the organization didn’t take reasonable security steps.
• Unwanted marketing. Nuisance calls, texts or emails. The ICO has separate reporting tools for these under PECR.

The ICO doesn’t handle disputes that aren’t about data, such as a faulty product, a billing complaint or a defamatory post by an individual. For defamation, see our guide to UK defamation law.

Step 1: Raise your concern with the organization first

The ICO expects organizations to have the first chance to fix the problem. If you haven’t contacted the organization, the ICO will usually tell you to do that before it looks at your complaint.

1. Find the right contact. The organization’s privacy notice should name a data protection officer or privacy contact. Use that address rather than general customer service where you can.
2. Say clearly what the problem is. Name the law if you can, for example “my subject access request dated 3 March has not been answered.”
3. Say what you want. A copy of your data, a correction, deletion, an apology or an explanation. Being specific makes a helpful answer more likely.
4. Give a reasonable deadline. For a complaint about how your data was handled, a few weeks is usually fair. For an access request, the legal deadline already applies.
5. Keep everything. Save copies of what you sent, when, and any reply.

Here’s example wording you can adapt:

Subject: Data protection complaint

To the data protection officer,

I am writing to raise a concern about how you have handled my personal data. On [date], I [made a subject access request / asked you to delete my data / discovered my details had been shared with a third party]. [Describe what happened.]

I would like you to [provide my data / delete the data / explain the lawful basis for sharing it / correct the record]. Please respond by [date]. If this isn’t resolved, I intend to raise the matter with the Information Commissioner’s Office.

[Your name, contact details and any account or reference numbers]

Step 2: Decide whether to escalate

Once the organization has replied, or the deadline has passed, decide whether the ICO is the right next step. Escalating makes sense when:

• The organization ignored you.
• It refused your request without a reason the law recognizes.
• Its answer was incomplete, for example a subject access response with obvious gaps.
• The same problem keeps happening after it said it had fixed it.

Keep the timing in mind. The ICO generally asks people to bring a complaint within three months of their last meaningful contact with the organization. It may not look at a complaint that’s much older, though it can make exceptions.

Step 3: Submit your ICO complaint

1. Go to the ICO’s official website. Type ico.org.uk yourself and use its “make a complaint” section. Complaining is free, so ignore any service that charges to “file with the ICO” for you.
2. Choose the right complaint type. The ICO has separate routes for data protection complaints, nuisance calls and messages, and freedom of information complaints.
3. Explain what happened. Name the organization, give dates, describe what you asked for and what went wrong.
4. Attach your evidence. Copies of your request, the organization’s reply or proof that it didn’t reply, and anything else that supports what you’re saying.
5. Say what outcome you want. For example, that the organization provides your data or deletes it.
6. Keep your reference. Note the case reference the ICO gives you for any follow-up.

Timescales depend on the ICO’s workload and the complexity of the case, so allow some time before chasing.

What the ICO can and can’t do

The ICO can	The ICO can’t
Look at your complaint and give its view on whether the organization complied with the law	Award you compensation
Ask the organization to take steps, such as answering your access request or reviewing its practices	Act as your lawyer or represent you in court
Take formal enforcement action in serious cases, such as reprimands, enforcement notices or fines	Promise to investigate every complaint in depth
Use complaints to spot patterns and target wider investigations	Deal with problems that aren’t about information rights

In most individual cases, the result is an outcome letter setting out the ICO’s view and any action it has asked the organization to take. That can still be enough: a letter from the regulator often prompts a stalled organization to answer.

If you want compensation for distress or financial loss caused by a breach of data protection law, that’s a claim you’d bring through the courts. Talk to a solicitor before going down that route.

If you’re unhappy with how the ICO handled it

• Ask for a review. If you think the ICO got the facts wrong or missed something, you can ask it to review how your case was handled. It publishes how to do this on its website.
• Apply to the tribunal in limited cases. The Data Protection Act 2018 lets you apply to the First-tier Tribunal if the ICO fails to take appropriate steps to respond to your complaint or keep you informed. The tribunal looks at the ICO’s handling, not whether you win your underlying dispute.
• Consider the courts. You can take court action against the organization yourself, whether or not you complained to the ICO. Get legal advice first.

A worked example

This is an illustrative scenario, not a real client. Callum, a warehouse supervisor in Leeds, leaves a job on bad terms and sends his former employer a subject access request for emails that mention him. After six weeks, nothing has come back.

• He sends a reminder to the HR team and the data protection contact in the employer’s privacy notice, quoting his original request and the date the one-month deadline passed.
• The employer sends a partial response: his HR file, but no emails, and no explanation of why.
• He writes once more asking for the missing emails or the legal reason they’ve been withheld, and gives two weeks.
• With no reply, he submits an ICO complaint, attaching his request, the reminder, the partial response and his follow-up.

The ICO writes to the employer and asks it to complete the response or explain its reasons. Callum can’t control what the ICO decides, but his clear paper trail makes the case easy to follow.

Common mistakes

• Skipping the organization. The ICO will usually send you back to complain to it first.
• Waiting too long. Bring the complaint within three months of your last meaningful contact where you can.
• Expecting compensation from the ICO. That needs a court claim.
• Sending no evidence. Without copies of your request and the replies, the ICO can’t assess what happened.
• Complaining about content rather than data. A negative review or news story is usually a matter for the platform, a publisher or defamation law, not the ICO.

When to get help

You can make an ICO complaint yourself without a solicitor or any cost. Get help if the data problem is part of a legal dispute, or if you’re trying to clear harmful search results and listings at the same time. Our content removal service handles removal and delisting requests and tells you honestly which ones are likely to work. For the search engine side, our guide to the right to be forgotten explains how delisting requests work.

Frequently asked questions

Is it free to complain to the ICO?

Yes. Complaining to the Information Commissioner’s Office is free, and you don’t need a solicitor to do it. Be wary of any service that charges to submit a complaint on your behalf.

How long do I have to make an ICO complaint?

The ICO generally asks you to raise your complaint within three months of your last meaningful contact with the organization. It may not look at older complaints, though it can consider exceptions.

Can the ICO make an organization pay me compensation?

No. The ICO can give its view, ask the organization to put things right and take enforcement action, but compensation for distress or loss is a matter for the courts.

Can I complain to the ICO if Google won't remove a result about me?

Yes. If a search engine refuses your delisting request under UK data protection law, you can ask the ICO to consider whether that decision was right.

Do I have to be in the UK to complain to the ICO?

The ICO handles complaints about organizations covered by UK data protection law, which can include complaints from people outside the UK. If the organization is based elsewhere and not covered, your own country’s regulator is usually the better route.