Enter your t

Data Protection Complaint Policy

How to raise a concern about your personal data

Version 1.0  |  April 2026  |  Reflects section 164A of the Data Protection Act 2018 as inserted by the Data (Use and Access) Act 2025

 1.  Introduction

We take the handling of your personal data seriously. If you believe we have not handled it correctly, or you are unhappy with how we have collected, used, stored, or shared it, you have the right to complain directly to us.

This policy explains how to make a data protection complaint, what happens when you do, and the timescales you can expect.

From 19 June 2026, all data controllers are legally required to have a formal internal complaints procedure under section 164A of the Data Protection Act 2018, as inserted by the Data (Use and Access) Act 2025. This policy fulfils that requirement.

2.  Who We Are

Noel Guilford, sole trader trading as Guilford Accounting, is the data controller for all personal data described in our Privacy Notice.

3.  Your Right to Complain

You can complain to us if you believe there has been a problem with how we have handled your personal data. You do not need to prove that something has gone wrong. If you have a concern, we want to hear about it.

Your complaint can be about any aspect of data protection, including:

• how we collected your personal data
• how we are using, storing or sharing your data
• the accuracy of the data we hold about you
• how long we are keeping your data
• a response (or non-response) to a data subject access request
• how we have handled your data in connection with marketing
• any other concern about your data protection rights

You can also authorise someone else to complain on your behalf. We may ask for proof of that authority before sharing details with them.

4.  How to Make a Complaint

You can submit a complaint by any of the following means:

To help us look into your complaint quickly, please include:

• your name and contact details
• a description of what has happened or what you are concerned about
• any relevant dates, reference numbers, or correspondence
• the outcome you are hoping for, if you have one in mind

Section 164A(2) of the Data Protection Act 2018 requires us to provide at least one electronic means for submitting complaints. Email satisfies this requirement.

 5.  What Happens Next

5.1  Acknowledgement

We will acknowledge your complaint within 30 days of receiving it. This is a legal deadline. Our acknowledgement will include a reference number and confirmation of who is handling your complaint.

5.2  Investigation

We will then investigate your complaint. This may involve reviewing our records and systems, speaking to anyone involved in the processing concerned, and, where relevant, contacting any third-party processor whose work is the subject of your complaint.

We will keep you updated on progress. If the investigation is taking longer than expected, we will write to you to explain why, give a revised timeframe, and confirm your point of contact.

5.3  Outcome

Once we have completed our investigation, we will write to you with our findings. We will explain clearly:

• what we found during the investigation
• whether your complaint is upheld in full, in part, or not upheld
• what action we have taken or will take as a result
• your options if you remain unhappy

We aim to resolve complaints without undue delay. For straightforward matters we will normally respond within a few weeks of acknowledgement.

 6.  Verifying Your Identity

To protect your personal data, we may need to verify your identity before sharing details about our investigation with you. We will only ask for information that is reasonable and proportionate to the request.

If someone is making a complaint on your behalf, we will ask them to confirm they have your authority before discussing the details with them.

 7.  Complaints Involving Children

Children under 18 have the same data protection rights as adults. If a complaint is made by or on behalf of a child, we will:

• prioritise the child's best interests throughout the process
• use clear, age-appropriate language in our communications
• consider the child's capacity to understand and exercise their rights on a case-by-case basis
• where a parent, guardian, or other representative makes the complaint, verify their authority and take account of the child's own views where appropriate

 8.  If You Are Not Satisfied

8.1  Ask us to review our decision

If you feel we have not fully addressed your concerns, please let us know. We will arrange for a senior review of the complaint. We aim to complete any such review within 14 days of your request.

8.2  Complain to the ICO

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator. The ICO generally expects you to raise your concern with us first, to give us the opportunity to put things right.

9.  How We Use Your Complaint Data

When you make a complaint, we collect and process personal data about you in order to investigate and respond. We do this on the basis of our legal obligation under section 164A of the Data Protection Act 2018, and our legitimate interests in resolving complaints and demonstrating compliance.

We will only collect information that is necessary. We will keep complaint records for six years from the date the complaint is closed, to demonstrate our compliance and allow us to identify improvements.

Full details of how we handle personal data are in our Privacy Notice.

 10.  Unreasonable or Abusive Complaints

We are committed to treating all complainants fairly and with respect, and we ask the same in return. If a complaint is made in a way that is abusive, threatening, or vexatious, we reserve the right to limit our engagement while still meeting our legal obligations under data protection law. We will always explain our reasons if we take this step.

 11.  Key Timescales at a Glance

12.  Review of This Policy

This policy was last reviewed in April 2026. We will review it whenever there are material changes to the law or to our business practices, and at least annually.

Document Control

This policy reflects the requirements of section 164A of the Data Protection Act 2018 as inserted by the Data (Use and Access) Act 2025. It is specific to Guilford Accounting and should be read alongside our Privacy Notice. It does not constitute legal advice.

Guilford Accounting  |  noel@guilfordaccounting.co.uk  |  guilfordaccounting.co.uk  |  Version 1.0, April 2026

ext here...