How to Make a Complaint to the ICO

When a complaint to the ICO is the right step

The Information Commissioner's Office (ICO) is the UK's independent regulator for data protection. If you believe an organisation has mishandled your personal data — for example by ignoring a data subject access request, refusing one without a valid reason, or using your information in a way you did not expect — the ICO is the body you can raise a concern with.

The ICO expects you to take one step first: raise the matter directly with the organisation involved and give it a reasonable chance to put things right. Most concerns are resolved at that stage, and the organisation must tell you how to escalate if you remain unhappy. A complaint to the ICO is best thought of as an escalation route, not a first move.

It also helps to act in good time. The ICO generally prefers you to come to it while the matter is still recent — commonly within three months of your last meaningful contact with the organisation about the issue. Raising your concern promptly keeps the records fresh and makes it easier for everyone to understand what happened.

• The ICO handles concerns about how UK organisations collect, use, or look after personal data.
• Raise the issue with the organisation first — that is the step the ICO expects before it gets involved.
• Bring your concern to the ICO while it is still recent, ideally within three months of your last contact about it.

How to make the complaint

Complaining to the ICO is free, and you do not need a lawyer. You can submit a concern through the ICO's own website or by post, and it helps to have a short, clear account of what happened and any reply you already received from the organisation. Working through a simple order keeps the complaint complete and easy to follow.

• 1. Gather your record — your original request or message, the date you sent it, and the organisation's reply (or a note that it did not reply).
• 2. Write a short summary — explain what happened, what you asked for, and why you are still unhappy, in plain terms.
• 3. Submit it to the ICO — use the ICO's official website (ico.org.uk) or write to it by post; there is no charge.
• 4. Keep a dated copy of everything you send, for your own records.
• 5. Wait for the ICO to come back to you — it will review your concern and let you know what, if anything, it intends to do.

What the ICO can and cannot do

The ICO can look into your concern, ask the organisation questions, and offer it guidance on how to handle personal data correctly. Where it finds a serious or repeated failing, the ICO has formal powers as a regulator. Most concerns, though, end with the ICO giving the organisation advice on what to do differently — which is often exactly what gets your own issue resolved.

There are limits worth knowing. The ICO does not award compensation; if you are seeking damages, that is a matter for the courts rather than the regulator. The ICO also focuses on the organisation's wider handling of data, so the outcome may be guidance to the organisation rather than a specific order in your individual case.

Whatever the outcome, raising a concern is your right, and it costs nothing to do. OSINTA helps you understand your own footprint and frame and route your own requests with your findings in front of you — it does not complain on your behalf, and the decision to escalate always stays with you. This is general information, not legal advice.

• Can do — review your concern, question the organisation, and give it guidance; use formal regulatory powers where a failing is serious.
• Cannot do — award you compensation; that is a matter for the courts, not the regulator.
• Focuses on the organisation's handling of data, so the result may be advice to the organisation rather than an order in your individual case.

Frequently asked questions

Related terms

• Data protection regulator
• GDPR (General Data Protection Regulation)
• Data Subject Access Request (DSAR)
• Data controller