Making a complaint that lands

A complaint succeeds or fails on structure more than on strength of feeling. The version that gets answered ties each allegation to a provision, states facts before conclusions, and asks questions that have answers.

Complain to the organisation first

In most cases the regulator will expect you to have raised it with the controllerControllerDecides why and how personal data is processed. Carries most of the duties — and the fines. and given them a reasonable opportunity to respond. That is not a barrier — it is the step that generates the evidence. A controller that ignores a well-formed complaint has handed you the best fact in your eventual escalation.

Address it to the data protection officer where there is one, not only to customer services. Different queue, different obligations, different competence.

Get the evidence first, if you do not have it

A subject access request is the standard way to find out what an organisation actually holds and who it told. It is free, it has a one-month deadline, and the response frequently contains the material that founds the substantive complaint — including internal notes and records of disclosures you did not know about.

Two things worth knowing:

• Make the access request separately from the complaint, in its own email, so the deadline is unambiguous and the response cannot be folded into a general reply.
• A response that contradicts what you were told earlier is itself a finding. If support said no such record existed and the access response contains it, say so plainly and quote both.

See the subject access procedure for the mechanics.

The structure that works

1. What you want, in one sentence, at the top. Rectification, deletion, an explanation, an acknowledgement.
2. The facts, in date order, with dates. What you sent, when, what came back.
3. Each allegation tied to a provision, one per paragraph. Not a list of grievances — a list of specific failures.
4. Pre-empt the obvious defence. If you expect “legitimate interestsLegitimate interestsUpdate: DUAA 2025 introduced a \”, say why it fails before they assert it, and attack necessity separately from the balance.
5. A deadline. “I expect a substantive response by [date]” converts silence into a measurable fact.
6. The escalation route, stated without drama. Naming the regulator and any sector ombudsman is information, not a threat.

Sentences that do a lot of work

• “I first raised this on [date] and have received no substantive response.” — establishes delay as a fact rather than a feeling.
• “Please confirm the lawful basis relied on for [specific act], and provide the assessment and its date.” — either produces the document or establishes it does not exist.
• “Please confirm what happened to the original inaccurate record, not only that current records are correct.” — closes the gap between acting and acknowledging.
• “Please confirm which third parties received this data, by name, and on what date.” — the question most people never ask.
• “Please confirm receipt.” — makes a later “we never got it” untenable.

What to avoid

• Volume. A twelve-page letter with four good points is easier to deflect than a one-page letter with four good points, because the reply can address the weakest.
• Conclusions before facts. “This is unlawful” invites a legal argument. “You shared X with Y on [date], and Y had no involvement” invites an answer.
• Threatening compensation as leverage. It shifts the exchange from compliance to negotiation, and organisations are much better at negotiation.
• Mixing the service complaint with the data complaint. They go to different places and are decided on different criteria. Cross-refer them; do not fuse them.

Escalating

You can complain to the supervisory authority, and separately pursue a judicial remedy. In regulated sectors an ombudsman may also handle the service dispute — these run in parallel and decide different questions. The regulator will not order compensation; a court may.

When you escalate, send the regulator the same structured document, plus the correspondence trail. The single most persuasive thing you can include is a clear timeline showing what you asked and when, and what came back — or did not.

Keep it usable afterwards

Keep everything in one thread where possible, keep your own copies, and note the date of each exchange as it happens. Almost every complaint that stalls does so because the timeline has to be reconstructed months later from memory.