Most complaints that end at a regulator did not need to. They escalated because of how they were handled in the first fortnight, not because of what originally went wrong.
Recognising what you are holding
Correspondence has left customer-service territory when any of these appear:
- an article or a named right is cited
- evidence is attached that was previously supplied
- a subject access request is referenced, made, or its results quoted back at you
- a deadline is stated
- an ombudsman or supervisory authority is named
- the writer asks what happened to an earlier record, rather than whether the current one is right
Any one of those means the reply must come from someone who knows what the cited provision requires, and it must be in writing. A friendly apology from an agent who has not read the file is the single most reliable way to make things worse, because it becomes evidence that the organisation engaged and still failed to address the point.
The first hour
- Acknowledge in writing, with a named owner and a date by which a substantive response will follow. This costs nothing and removes the “no response” allegation entirely.
- Start a timeline from your own records — every message in and out, with dates. Do this before you form a view. You will need it whatever the outcome, and it frequently changes the view.
- Separate the strands. A single letter often contains a rights request, a service complaint, and an allegation about a disclosure. They have different deadlines, different owners and different remedies.
- Diary the deadlines. Rights requests run to one month from receipt, extendable by two for complex or numerous requests only if you tell them inside the first month.
- Preserve. Do not let routine deletion run over material now in dispute — and be aware that altering or destroying records to frustrate disclosure is a criminal offence in some regimes, including the UK.
The three failures that escalate complaints
Answering some points and going quiet on others. The most common by far. A reply that addresses two of three allegations reads as evasion even when it is just an oversight, and it hands the complainant a clean escalation. Answer every numbered point, including the ones where the answer is “we do not agree, and here is why”.
Confusing acting with acknowledging. Quietly fixing the underlying problem while never responding to the challenge leaves the complainant unable to distinguish you from an organisation that ignored them. Say what you did.
Asserting a lawful basis without the analysis. Replying “we rely on legitimate interests” to someone who has already explained why the necessity limb fails does not engage with the complaint. Either produce the assessment or concede the point. See the legitimate interests assessment.
Answering the substance
Structure the reply to mirror their letter, point by point, in their order. For each:
- what you found in your records, with dates
- what you have decided
- what you have done, and where
- if you disagree, why — with the reasoning, not the conclusion
Then close with the things people forget: whether recipients of any corrected data have been notified, whether you have assessed the breach threshold, and their right to complain to the supervisory authority and to a judicial remedy. Volunteering that last one is not an invitation — it is a requirement in several circumstances, and withholding it looks worse than the original complaint.
When the complainant suggests you self-report
Take it as a prompt to run the assessment, not as an attack. A documented assessment concluding “not notifiable”, with reasoning, is a good outcome. No assessment at all is the bad one. See when to report yourself.
If it has already been months
Deal with the delay first, separately, and without excuses. Say how long it has been, acknowledge it plainly, and give a date. Do not bury it in paragraph six.
Delay is the fact a regulator assesses before it assesses anything else, because it is objective and undeniable. It is also the only part of the complaint you definitely cannot argue your way out of — so removing it from the dispute early is worth more than any argument you might win on the substance.
What good looks like
The complainant can tell, from your reply alone, exactly what you found, what you decided, what changed, and what they can do next. If they escalate anyway, the regulator reads a document showing a controllerControllerDecides why and how personal data is processed. Carries most of the duties — and the fines. that investigated and explained itself. That is a materially different position from one that has to be reconstructed after the fact.